add controllers

change kiali mux to go-restful

add knative

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "vendor/github.com/knative/pkg"]
-	path = vendor/github.com/knative/pkg
-	url = https://github.com/knative/pkg.git

.travis.yml

@@ -15,12 +15,11 @@ before_install:
   - go get -u github.com/golang/dep/cmd/dep
 
 before_script:
-  - dep ensure -v
   - docker --version
   - bash hack/install_kubebuilder.sh
 
 script:
-  - make all && make test && bash hack/docker_build.sh
+  - make all && bash hack/docker_build.sh
 
 deploy:
   skip_cleanup: true

Gopkg.toml

@@ -14,7 +14,6 @@ required = [
     "sigs.k8s.io/controller-runtime/pkg/runtime/signals",
     "sigs.k8s.io/controller-runtime/pkg/source",
     "sigs.k8s.io/testing_frameworks/integration", # for integration testing
-    "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1",
     "github.com/kubesphere/s2ioperator/pkg/client/clientset/versioned",
     "github.com/kubesphere/s2ioperator/pkg/client/informers/externalversions",
     "github.com/kubesphere/s2ioperator/pkg/apis/devops/v1alpha1"
@@ -32,6 +31,10 @@ required = [
   name = "k8s.io/apimachinery"
   version = "kubernetes-1.13.1"
 
+[[override]]
+  name = "k8s.io/apiserver"
+  version = "kubernetes-1.13.1"
+
 [[constraint]]
   name = "k8s.io/code-generator"
   version = "kubernetes-1.13.1"
@@ -109,3 +112,7 @@ required = [
 [[constraint]]
   name = "github.com/gorilla/mux"
   version = "1.7.0"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/knative/pkg"

Makefile

@@ -28,7 +28,7 @@ define ALL_HELP_INFO
 #           debugging tools like delve.
 endef
 .PHONY: all
-all: test ks-apiserver ks-apigateway ks-iam
+all: test ks-apiserver ks-apigateway ks-iam controller-manager
 
 # Build ks-apiserver binary
 ks-apiserver: test
@@ -42,6 +42,10 @@ ks-apigateway: test
 ks-iam: test
 	hack/gobuild.sh cmd/ks-iam
 
+# Build controller-manager binary
+controller-manager: test
+	hack/gobuild.sh cmd/controller-manager
+
 # Run go fmt against code 
 fmt:
 	go fmt ./pkg/... ./cmd/...

build/controller-manager/Dockerfile

@@ -5,7 +5,7 @@
 # Copyright 2018 The KubeSphere Authors. All rights reserved.
 # Use of this source code is governed by a Apache license
 # that can be found in the LICENSE file.
-FROM golang:1.10.3 as controller-manager-builder
+FROM golang:1.12 as controller-manager-builder
 
 COPY / /go/src/kubesphere.io/kubesphere
 WORKDIR /go/src/kubesphere.io/kubesphere

cmd/controller-manager/app/controllers.go

@@ -0,0 +1,86 @@
+package app
+
+import (
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"kubesphere.io/kubesphere/pkg/controller/destinationrule"
+	"kubesphere.io/kubesphere/pkg/controller/virtualservice"
+	"kubesphere.io/kubesphere/pkg/informers"
+	"kubesphere.io/kubesphere/pkg/simple/controller/namespace"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"time"
+
+	logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
+
+	istioclientset "github.com/knative/pkg/client/clientset/versioned"
+	istioinformers "github.com/knative/pkg/client/informers/externalversions"
+	servicemeshclientset "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
+	servicemeshinformers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
+)
+
+const defaultResync = 600 * time.Second
+
+var log = logf.Log.WithName("controller-manager")
+
+func AddControllers(mgr manager.Manager, cfg *rest.Config, stopCh <-chan struct{}) error {
+
+	kubeClient, err := kubernetes.NewForConfig(cfg)
+	if err != nil {
+		log.Error(err, "building kubernetes client failed")
+	}
+
+	istioclient, err := istioclientset.NewForConfig(cfg)
+	if err != nil {
+		log.Error(err, "create istio client failed")
+		return err
+	}
+
+	informerFactory := informers.SharedInformerFactory()
+	istioInformer := istioinformers.NewSharedInformerFactory(istioclient, defaultResync)
+
+	servicemeshclient, err := servicemeshclientset.NewForConfig(cfg)
+	if err != nil {
+		log.Error(err, "create servicemesh client failed")
+		return err
+	}
+
+	servicemeshinformer := servicemeshinformers.NewSharedInformerFactory(servicemeshclient, defaultResync)
+
+	vsController := virtualservice.NewVirtualServiceController(informerFactory.Core().V1().Services(),
+		istioInformer.Networking().V1alpha3().VirtualServices(),
+		istioInformer.Networking().V1alpha3().DestinationRules(),
+		servicemeshinformer.Servicemesh().V1alpha2().Strategies(),
+		kubeClient,
+		istioclient)
+
+	drController := destinationrule.NewDestinationRuleController(informerFactory.Apps().V1().Deployments(),
+		istioInformer.Networking().V1alpha3().DestinationRules(),
+		informerFactory.Core().V1().Services(),
+		kubeClient,
+		istioclient)
+
+	nsController := namespace.NewNamespaceController(kubeClient,
+		informerFactory.Core().V1().Namespaces(),
+		informerFactory.Rbac().V1().Roles(),
+	)
+
+	servicemeshinformer.Start(stopCh)
+	istioInformer.Start(stopCh)
+	informerFactory.Start(stopCh)
+
+	controllers := map[string]manager.Runnable{
+		"virtualservice-controller":  vsController,
+		"destinationrule-controller": drController,
+		"namespace-controller":       nsController,
+	}
+
+	for name, ctrl := range controllers {
+		err = mgr.Add(ctrl)
+		if err != nil {
+			log.Error(err, "add controller to manager failed", "name", name)
+			return err
+		}
+	}
+
+	return nil
+}

cmd/controller-manager/app/helper.go

@@ -0,0 +1,38 @@
+package app
+
+import (
+	"fmt"
+	"k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/klog"
+	"net/http"
+	"time"
+)
+
+// WaitForAPIServer waits for the API Server's /healthz endpoint to report "ok" with timeout.
+func WaitForAPIServer(client clientset.Interface, timeout time.Duration) error {
+	var lastErr error
+
+	err := wait.PollImmediate(time.Second, timeout, func() (bool, error) {
+		healthStatus := 0
+		result := client.Discovery().RESTClient().Get().AbsPath("/healthz").Do().StatusCode(&healthStatus)
+		if result.Error() != nil {
+			lastErr = fmt.Errorf("failed to get apiserver /healthz status: %v", result.Error())
+			return false, nil
+		}
+		if healthStatus != http.StatusOK {
+			content, _ := result.Raw()
+			lastErr = fmt.Errorf("APIServer isn't healthy: %v", string(content))
+			klog.Warningf("APIServer isn't healthy yet: %v. Waiting a little while.", string(content))
+			return false, nil
+		}
+
+		return true, nil
+	})
+
+	if err != nil {
+		return fmt.Errorf("%v: %v", err, lastErr)
+	}
+
+	return nil
+}

cmd/controller-manager/controller-manager.go

@@ -20,93 +20,59 @@ package main
 
 import (
 	"flag"
-
+	"k8s.io/client-go/tools/clientcmd"
+	"kubesphere.io/kubesphere/cmd/controller-manager/app"
+	"kubesphere.io/kubesphere/pkg/apis"
+	"kubesphere.io/kubesphere/pkg/controller"
 	"os"
-	"sigs.k8s.io/application/pkg/apis/app/v1beta1"
-
-	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
-	"kubesphere.io/kubesphere/pkg/informers"
-	"kubesphere.io/kubesphere/pkg/simple/client/k8s"
-	"kubesphere.io/kubesphere/pkg/simple/controller/namespace"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
 	"sigs.k8s.io/controller-runtime/pkg/runtime/signals"
-
-	"kubesphere.io/kubesphere/pkg/apis"
-	"kubesphere.io/kubesphere/pkg/controller"
-	"kubesphere.io/kubesphere/pkg/webhook"
 )
 
 func main() {
-	var metricsAddr string
+	var metricsAddr, kubeConfigPath, masterURL string
 	flag.StringVar(&metricsAddr, "metrics-addr", ":8080", "The address the metric endpoint binds to.")
 	flag.Parse()
 	logf.SetLogger(logf.ZapLogger(false))
-	log := logf.Log.WithName("entrypoint")
+	log := logf.Log.WithName("controller-manager")
 
-	// Get a config to talk to the apiserver
-	log.Info("setting up client for manager")
-	cfg, err := k8s.Config()
+	kubeConfig, err := clientcmd.BuildConfigFromFlags(masterURL, kubeConfigPath)
 	if err != nil {
-		log.Error(err, "unable to set up client config")
+		log.Error(err, "failed to build kubeconfig")
 		os.Exit(1)
 	}
 
-	// Create a new Cmd to provide shared dependencies and start components
+	stopCh := signals.SetupSignalHandler()
+
 	log.Info("setting up manager")
-	mgr, err := manager.New(cfg, manager.Options{})
+	mgr, err := manager.New(kubeConfig, manager.Options{})
 	if err != nil {
 		log.Error(err, "unable to set up overall controller manager")
 		os.Exit(1)
 	}
 
-	log.Info("Registering Components.")
-
-	// Setup Scheme for all resources
 	log.Info("setting up scheme")
 	if err := apis.AddToScheme(mgr.GetScheme()); err != nil {
 		log.Error(err, "unable add APIs to scheme")
 		os.Exit(1)
 	}
 
-	log.Info("Print all known types")
-	for k, v := range mgr.GetScheme().AllKnownTypes() {
-		if k.Group == v1beta1.SchemeGroupVersion.Group {
-			log.Info(k.String() + " / " + v.String())
-		}
-	}
-
-	// Setup all Controllers
-	log.Info("Setting up controller")
+	log.Info("Setting up controllers")
 	if err := controller.AddToManager(mgr); err != nil {
 		log.Error(err, "unable to register controllers to the manager")
 		os.Exit(1)
 	}
 
-	log.Info("setting up webhooks")
-	if err := webhook.AddToManager(mgr); err != nil {
-		log.Error(err, "unable to register webhooks to the manager")
+	if err := app.AddControllers(mgr, kubeConfig, stopCh); err != nil {
+		log.Error(err, "unable to register controllers to the manager")
 		os.Exit(1)
 	}
 
-	err = mgr.Add(manager.RunnableFunc(func(s <-chan struct{}) error {
-		informerFactory := informers.SharedInformerFactory()
-		informerFactory.Start(s)
-		namespace.NewNamespaceController(k8s.Client(),
-			informerFactory.Core().V1().Namespaces(),
-			informerFactory.Rbac().V1().Roles()).Start(s)
-		return nil
-	}))
-
-	if err != nil {
-		log.Error(err, "error Adding controllers to the Manager")
-		os.Exit(1)
-	}
-
-	// Start the Cmd
 	log.Info("Starting the Cmd.")
-	if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
+	if err := mgr.Start(stopCh); err != nil {
 		log.Error(err, "unable to run the manager")
 		os.Exit(1)
 	}
+
 }

config/crds/servicemesh_v1alpha2_strategy.yaml

@@ -6,6 +6,23 @@ metadata:
     controller-tools.k8s.io: "1.0"
   name: strategies.servicemesh.kubesphere.io
 spec:
+  additionalPrinterColumns:
+  - JSONPath: .spec.type
+    description: type of strategy
+    name: Type
+    type: string
+  - JSONPath: .spec.template.spec.hosts
+    description: destination hosts
+    name: Hosts
+    type: string
+  - JSONPath: .metadata.creationTimestamp
+    description: 'CreationTimestamp is a timestamp representing the server time when
+      this object was created. It is not guaranteed to be set in happens-before order
+      across separate operations. Clients may not set this value. It is represented
+      in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
+      lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
+    name: Age
+    type: date
   group: servicemesh.kubesphere.io
   names:
     kind: Strategy
@@ -28,10 +45,18 @@ spec:
           type: object
         spec:
           properties:
+            governor:
+              description: Governor version, the version takes control of all incoming
+                traffic label version value
+              type: string
             paused:
               description: Indicates that the strategy is paused and will not be processed
                 by the strategy controller
               type: boolean
+            principal:
+              description: Principal version, the one as reference version label version
+                value
+              type: string
             selector:
               description: Label selector for virtual services.
               type: object

config/samples/servicemesh_v1alpha2_strategy.yaml

@@ -12,6 +12,8 @@ spec:
       "servicemesh.kubesphere.io/type": "canary"
   template:
     spec:
+      service: "details"
+      principal: "v1"
       hosts:
       - details
       http:

hack/docker_build.sh

@@ -2,4 +2,6 @@
 
  docker build -f build/ks-apigateway/Dockerfile -t kubespheredev/ks-apigateway:latest .
  docker build -f build/ks-apiserver/Dockerfile -t kubespheredev/ks-apiserver:latest .
- docker build -f build/ks-iam/Dockerfile -t kubespheredev/ks-iam:latest .
+ docker build -f build/ks-iam/Dockerfile -t kubespheredev/ks-iam:latest .
+
+ docker build -f build/controller-manager/Dockerfile -t kubespheredev/controller-manager:latest .

hack/docker_push.sh

@@ -6,3 +6,4 @@ echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
 docker push kubespheredev/ks-apigateway:latest
 docker push kubespheredev/ks-apiserver:latest
 docker push kubespheredev/ks-iam:latest
+docker push kubespheredev/controller-manager:latest

pkg/apis/addtoscheme_servicemesh_v1alpha2.go

@@ -20,7 +20,7 @@ import (
 	"github.com/knative/pkg/apis/istio/v1alpha3"
 	"kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
 
-	"sigs.k8s.io/application/pkg/apis/app/v1beta1"
+	"github.com/kubernetes-sigs/application/pkg/apis/app/v1beta1"
 )
 
 func init() {

pkg/apis/servicemesh/v1alpha2/strategy_types.go

@@ -45,6 +45,16 @@ type StrategySpec struct {
 	// Strategy type
 	Type StrategyType `json:"type,omitempty"`
 
+	// Principal version, the one as reference version
+	// label version value
+	// +optional
+	PrincipalVersion string `json:"principal,omitempty"`
+
+	// Governor version, the version takes control of all incoming traffic
+	// label version value
+	// +optional
+	GovernorVersion string `json:"governor,omitempty"`
+
 	// Label selector for virtual services.
 	// +optional
 	Selector *metav1.LabelSelector `json:"selector,omitempty"`
@@ -128,6 +138,9 @@ type StrategyCondition struct {
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // Strategy is the Schema for the strategies API
+// +kubebuilder:printcolumn:name="Type",type="string",JSONPath=".spec.type",description="type of strategy"
+// +kubebuilder:printcolumn:name="Hosts",type="string",JSONPath=".spec.template.spec.hosts",description="destination hosts"
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
 // +k8s:openapi-gen=true
 type Strategy struct {
 	metav1.TypeMeta   `json:",inline"`

pkg/apiserver/servicemesh/metrics/handlers.go

@@ -8,22 +8,29 @@ import (
 
 // Get app metrics
 func GetAppMetrics(request *restful.Request, response *restful.Response) {
-	handlers.AppMetrics(response.ResponseWriter, request.Request)
+	handlers.AppMetrics(request, response)
 }
 
 // Get workload metrics
 func GetWorkloadMetrics(request *restful.Request, response *restful.Response) {
-	handlers.WorkloadMetrics(response.ResponseWriter, request.Request)
+	namespace := request.PathParameter("namespace")
+	workload := request.PathParameter("workload")
+
+	if len(namespace) > 0 && len(workload) > 0 {
+		request.Request.URL.RawQuery = fmt.Sprintf("%s&namespaces=%s&workload=%s", request.Request.URL.RawQuery, namespace, workload)
+	}
+
+	handlers.WorkloadMetrics(request, response)
 }
 
 // Get service metrics
 func GetServiceMetrics(request *restful.Request, response *restful.Response) {
-	handlers.ServiceMetrics(response.ResponseWriter, request.Request)
+	handlers.ServiceMetrics(request, response)
 }
 
 // Get namespace metrics
 func GetNamespaceMetrics(request *restful.Request, response *restful.Response) {
-	handlers.NamespaceMetrics(response.ResponseWriter, request.Request)
+	handlers.NamespaceMetrics(request, response)
 }
 
 // Get service graph for namespace
@@ -34,10 +41,10 @@ func GetNamespaceGraph(request *restful.Request, response *restful.Response) {
 		request.Request.URL.RawQuery = fmt.Sprintf("%s&namespaces=%s", request.Request.URL.RawQuery, namespace)
 	}
 
-	handlers.GraphNamespaces(response.ResponseWriter, request.Request)
+	handlers.GetNamespaceGraph(request, response)
 }
 
 // Get service graph for namespaces
 func GetNamespacesGraph(request *restful.Request, response *restful.Response) {
-	handlers.GraphNamespaces(response.ResponseWriter, request.Request)
+	handlers.GraphNamespaces(request, response)
 }

pkg/client/clientset/versioned/clientset.go

@@ -0,0 +1,98 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package versioned
+
+import (
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/servicemesh/v1alpha2"
+)
+
+type Interface interface {
+	Discovery() discovery.DiscoveryInterface
+	ServicemeshV1alpha2() servicemeshv1alpha2.ServicemeshV1alpha2Interface
+	// Deprecated: please explicitly pick a version if possible.
+	Servicemesh() servicemeshv1alpha2.ServicemeshV1alpha2Interface
+}
+
+// Clientset contains the clients for groups. Each group has exactly one
+// version included in a Clientset.
+type Clientset struct {
+	*discovery.DiscoveryClient
+	servicemeshV1alpha2 *servicemeshv1alpha2.ServicemeshV1alpha2Client
+}
+
+// ServicemeshV1alpha2 retrieves the ServicemeshV1alpha2Client
+func (c *Clientset) ServicemeshV1alpha2() servicemeshv1alpha2.ServicemeshV1alpha2Interface {
+	return c.servicemeshV1alpha2
+}
+
+// Deprecated: Servicemesh retrieves the default version of ServicemeshClient.
+// Please explicitly pick a version.
+func (c *Clientset) Servicemesh() servicemeshv1alpha2.ServicemeshV1alpha2Interface {
+	return c.servicemeshV1alpha2
+}
+
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// NewForConfig creates a new Clientset for the given config.
+func NewForConfig(c *rest.Config) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+	var cs Clientset
+	var err error
+	cs.servicemeshV1alpha2, err = servicemeshv1alpha2.NewForConfig(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *Clientset {
+	var cs Clientset
+	cs.servicemeshV1alpha2 = servicemeshv1alpha2.NewForConfigOrDie(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c)
+	return &cs
+}
+
+// New creates a new Clientset for the given RESTClient.
+func New(c rest.Interface) *Clientset {
+	var cs Clientset
+	cs.servicemeshV1alpha2 = servicemeshv1alpha2.New(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
+	return &cs
+}

pkg/client/clientset/versioned/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated clientset.
+package versioned

pkg/client/clientset/versioned/fake/clientset_generated.go

@@ -0,0 +1,82 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/discovery"
+	fakediscovery "k8s.io/client-go/discovery/fake"
+	"k8s.io/client-go/testing"
+	clientset "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
+	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/servicemesh/v1alpha2"
+	fakeservicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/servicemesh/v1alpha2/fake"
+)
+
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewSimpleClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	testing.Fake
+	discovery *fakediscovery.FakeDiscovery
+}
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+	return c.discovery
+}
+
+var _ clientset.Interface = &Clientset{}
+
+// ServicemeshV1alpha2 retrieves the ServicemeshV1alpha2Client
+func (c *Clientset) ServicemeshV1alpha2() servicemeshv1alpha2.ServicemeshV1alpha2Interface {
+	return &fakeservicemeshv1alpha2.FakeServicemeshV1alpha2{Fake: &c.Fake}
+}
+
+// Servicemesh retrieves the ServicemeshV1alpha2Client
+func (c *Clientset) Servicemesh() servicemeshv1alpha2.ServicemeshV1alpha2Interface {
+	return &fakeservicemeshv1alpha2.FakeServicemeshV1alpha2{Fake: &c.Fake}
+}

pkg/client/clientset/versioned/fake/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake

pkg/client/clientset/versioned/fake/register.go

@@ -0,0 +1,56 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+var parameterCodec = runtime.NewParameterCodec(scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	servicemeshv1alpha2.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//   import (
+//     "k8s.io/client-go/kubernetes"
+//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//   )
+//
+//   kclientset, _ := kubernetes.NewForConfig(c)
+//   _ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(scheme))
+}

pkg/client/clientset/versioned/scheme/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme

pkg/client/clientset/versioned/scheme/register.go

@@ -0,0 +1,56 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	servicemeshv1alpha2.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//   import (
+//     "k8s.io/client-go/kubernetes"
+//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//   )
+//
+//   kclientset, _ := kubernetes.NewForConfig(c)
+//   _ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(Scheme))
+}

pkg/client/clientset/versioned/typed/servicemesh/v1alpha2/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha2

pkg/client/clientset/versioned/typed/servicemesh/v1alpha2/fake/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake

pkg/client/clientset/versioned/typed/servicemesh/v1alpha2/fake/fake_servicemesh_client.go

@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/servicemesh/v1alpha2"
+)
+
+type FakeServicemeshV1alpha2 struct {
+	*testing.Fake
+}
+
+func (c *FakeServicemeshV1alpha2) Strategies(namespace string) v1alpha2.StrategyInterface {
+	return &FakeStrategies{c, namespace}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeServicemeshV1alpha2) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}

pkg/client/clientset/versioned/typed/servicemesh/v1alpha2/fake/fake_strategy.go

@@ -0,0 +1,140 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
+)
+
+// FakeStrategies implements StrategyInterface
+type FakeStrategies struct {
+	Fake *FakeServicemeshV1alpha2
+	ns   string
+}
+
+var strategiesResource = schema.GroupVersionResource{Group: "servicemesh.kubesphere.io", Version: "v1alpha2", Resource: "strategies"}
+
+var strategiesKind = schema.GroupVersionKind{Group: "servicemesh.kubesphere.io", Version: "v1alpha2", Kind: "Strategy"}
+
+// Get takes name of the strategy, and returns the corresponding strategy object, and an error if there is any.
+func (c *FakeStrategies) Get(name string, options v1.GetOptions) (result *v1alpha2.Strategy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(strategiesResource, c.ns, name), &v1alpha2.Strategy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.Strategy), err
+}
+
+// List takes label and field selectors, and returns the list of Strategies that match those selectors.
+func (c *FakeStrategies) List(opts v1.ListOptions) (result *v1alpha2.StrategyList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(strategiesResource, strategiesKind, c.ns, opts), &v1alpha2.StrategyList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha2.StrategyList{ListMeta: obj.(*v1alpha2.StrategyList).ListMeta}
+	for _, item := range obj.(*v1alpha2.StrategyList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested strategies.
+func (c *FakeStrategies) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(strategiesResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a strategy and creates it.  Returns the server's representation of the strategy, and an error, if there is any.
+func (c *FakeStrategies) Create(strategy *v1alpha2.Strategy) (result *v1alpha2.Strategy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(strategiesResource, c.ns, strategy), &v1alpha2.Strategy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.Strategy), err
+}
+
+// Update takes the representation of a strategy and updates it. Returns the server's representation of the strategy, and an error, if there is any.
+func (c *FakeStrategies) Update(strategy *v1alpha2.Strategy) (result *v1alpha2.Strategy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(strategiesResource, c.ns, strategy), &v1alpha2.Strategy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.Strategy), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeStrategies) UpdateStatus(strategy *v1alpha2.Strategy) (*v1alpha2.Strategy, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceAction(strategiesResource, "status", c.ns, strategy), &v1alpha2.Strategy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.Strategy), err
+}
+
+// Delete takes name of the strategy and deletes it. Returns an error if one occurs.
+func (c *FakeStrategies) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(strategiesResource, c.ns, name), &v1alpha2.Strategy{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeStrategies) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(strategiesResource, c.ns, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha2.StrategyList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched strategy.
+func (c *FakeStrategies) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.Strategy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(strategiesResource, c.ns, name, pt, data, subresources...), &v1alpha2.Strategy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.Strategy), err
+}

pkg/client/clientset/versioned/typed/servicemesh/v1alpha2/generated_expansion.go

@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+type StrategyExpansion interface{}

pkg/client/clientset/versioned/typed/servicemesh/v1alpha2/servicemesh_client.go

@@ -0,0 +1,90 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	rest "k8s.io/client-go/rest"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/client/clientset/versioned/scheme"
+)
+
+type ServicemeshV1alpha2Interface interface {
+	RESTClient() rest.Interface
+	StrategiesGetter
+}
+
+// ServicemeshV1alpha2Client is used to interact with features provided by the servicemesh.kubesphere.io group.
+type ServicemeshV1alpha2Client struct {
+	restClient rest.Interface
+}
+
+func (c *ServicemeshV1alpha2Client) Strategies(namespace string) StrategyInterface {
+	return newStrategies(c, namespace)
+}
+
+// NewForConfig creates a new ServicemeshV1alpha2Client for the given config.
+func NewForConfig(c *rest.Config) (*ServicemeshV1alpha2Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return &ServicemeshV1alpha2Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new ServicemeshV1alpha2Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ServicemeshV1alpha2Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new ServicemeshV1alpha2Client for the given RESTClient.
+func New(c rest.Interface) *ServicemeshV1alpha2Client {
+	return &ServicemeshV1alpha2Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) error {
+	gv := v1alpha2.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = serializer.DirectCodecFactory{CodecFactory: scheme.Codecs}
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	return nil
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ServicemeshV1alpha2Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}

pkg/client/clientset/versioned/typed/servicemesh/v1alpha2/strategy.go

@@ -0,0 +1,191 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
+	scheme "kubesphere.io/kubesphere/pkg/client/clientset/versioned/scheme"
+)
+
+// StrategiesGetter has a method to return a StrategyInterface.
+// A group's client should implement this interface.
+type StrategiesGetter interface {
+	Strategies(namespace string) StrategyInterface
+}
+
+// StrategyInterface has methods to work with Strategy resources.
+type StrategyInterface interface {
+	Create(*v1alpha2.Strategy) (*v1alpha2.Strategy, error)
+	Update(*v1alpha2.Strategy) (*v1alpha2.Strategy, error)
+	UpdateStatus(*v1alpha2.Strategy) (*v1alpha2.Strategy, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha2.Strategy, error)
+	List(opts v1.ListOptions) (*v1alpha2.StrategyList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.Strategy, err error)
+	StrategyExpansion
+}
+
+// strategies implements StrategyInterface
+type strategies struct {
+	client rest.Interface
+	ns     string
+}
+
+// newStrategies returns a Strategies
+func newStrategies(c *ServicemeshV1alpha2Client, namespace string) *strategies {
+	return &strategies{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the strategy, and returns the corresponding strategy object, and an error if there is any.
+func (c *strategies) Get(name string, options v1.GetOptions) (result *v1alpha2.Strategy, err error) {
+	result = &v1alpha2.Strategy{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("strategies").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Strategies that match those selectors.
+func (c *strategies) List(opts v1.ListOptions) (result *v1alpha2.StrategyList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha2.StrategyList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("strategies").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested strategies.
+func (c *strategies) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("strategies").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch()
+}
+
+// Create takes the representation of a strategy and creates it.  Returns the server's representation of the strategy, and an error, if there is any.
+func (c *strategies) Create(strategy *v1alpha2.Strategy) (result *v1alpha2.Strategy, err error) {
+	result = &v1alpha2.Strategy{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("strategies").
+		Body(strategy).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a strategy and updates it. Returns the server's representation of the strategy, and an error, if there is any.
+func (c *strategies) Update(strategy *v1alpha2.Strategy) (result *v1alpha2.Strategy, err error) {
+	result = &v1alpha2.Strategy{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("strategies").
+		Name(strategy.Name).
+		Body(strategy).
+		Do().
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+
+func (c *strategies) UpdateStatus(strategy *v1alpha2.Strategy) (result *v1alpha2.Strategy, err error) {
+	result = &v1alpha2.Strategy{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("strategies").
+		Name(strategy.Name).
+		SubResource("status").
+		Body(strategy).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the strategy and deletes it. Returns an error if one occurs.
+func (c *strategies) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("strategies").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *strategies) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	var timeout time.Duration
+	if listOptions.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOptions.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("strategies").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched strategy.
+func (c *strategies) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.Strategy, err error) {
+	result = &v1alpha2.Strategy{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("strategies").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/informers/externalversions/factory.go

@@ -0,0 +1,180 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	reflect "reflect"
+	sync "sync"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
+	internalinterfaces "kubesphere.io/kubesphere/pkg/client/informers/externalversions/internalinterfaces"
+	servicemesh "kubesphere.io/kubesphere/pkg/client/informers/externalversions/servicemesh"
+)
+
+// SharedInformerOption defines the functional option type for SharedInformerFactory.
+type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
+
+type sharedInformerFactory struct {
+	client           versioned.Interface
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	lock             sync.Mutex
+	defaultResync    time.Duration
+	customResync     map[reflect.Type]time.Duration
+
+	informers map[reflect.Type]cache.SharedIndexInformer
+	// startedInformers is used for tracking which informers have been started.
+	// This allows Start() to be called multiple times safely.
+	startedInformers map[reflect.Type]bool
+}
+
+// WithCustomResyncConfig sets a custom resync period for the specified informer types.
+func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		for k, v := range resyncConfig {
+			factory.customResync[reflect.TypeOf(k)] = v
+		}
+		return factory
+	}
+}
+
+// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
+func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.tweakListOptions = tweakListOptions
+		return factory
+	}
+}
+
+// WithNamespace limits the SharedInformerFactory to the specified namespace.
+func WithNamespace(namespace string) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.namespace = namespace
+		return factory
+	}
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync)
+}
+
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client versioned.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
+}
+
+// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
+func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
+	factory := &sharedInformerFactory{
+		client:           client,
+		namespace:        v1.NamespaceAll,
+		defaultResync:    defaultResync,
+		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
+		startedInformers: make(map[reflect.Type]bool),
+		customResync:     make(map[reflect.Type]time.Duration),
+	}
+
+	// Apply all options
+	for _, opt := range options {
+		factory = opt(factory)
+	}
+
+	return factory
+}
+
+// Start initializes all requested informers.
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			go informer.Run(stopCh)
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+// WaitForCacheSync waits for all started informers' cache were synced.
+func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	informers := func() map[reflect.Type]cache.SharedIndexInformer {
+		f.lock.Lock()
+		defer f.lock.Unlock()
+
+		informers := map[reflect.Type]cache.SharedIndexInformer{}
+		for informerType, informer := range f.informers {
+			if f.startedInformers[informerType] {
+				informers[informerType] = informer
+			}
+		}
+		return informers
+	}()
+
+	res := map[reflect.Type]bool{}
+	for informType, informer := range informers {
+		res[informType] = cache.WaitForCacheSync(stopCh, informer.HasSynced)
+	}
+	return res
+}
+
+// InternalInformerFor returns the SharedIndexInformer for obj using an internal
+// client.
+func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(obj)
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+
+	resyncPeriod, exists := f.customResync[informerType]
+	if !exists {
+		resyncPeriod = f.defaultResync
+	}
+
+	informer = newFunc(f.client, resyncPeriod)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// SharedInformerFactory provides shared informers for resources in all known
+// API group versions.
+type SharedInformerFactory interface {
+	internalinterfaces.SharedInformerFactory
+	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
+
+	Servicemesh() servicemesh.Interface
+}
+
+func (f *sharedInformerFactory) Servicemesh() servicemesh.Interface {
+	return servicemesh.New(f, f.namespace, f.tweakListOptions)
+}

pkg/client/informers/externalversions/generic.go

@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	"fmt"
+
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
+)
+
+// GenericInformer is type of SharedIndexInformer which will locate and delegate to other
+// sharedInformers based on type
+type GenericInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.GenericLister
+}
+
+type genericInformer struct {
+	informer cache.SharedIndexInformer
+	resource schema.GroupResource
+}
+
+// Informer returns the SharedIndexInformer.
+func (f *genericInformer) Informer() cache.SharedIndexInformer {
+	return f.informer
+}
+
+// Lister returns the GenericLister.
+func (f *genericInformer) Lister() cache.GenericLister {
+	return cache.NewGenericLister(f.Informer().GetIndexer(), f.resource)
+}
+
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
+	switch resource {
+	// Group=servicemesh.kubesphere.io, Version=v1alpha2
+	case v1alpha2.SchemeGroupVersion.WithResource("strategies"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Servicemesh().V1alpha2().Strategies().Informer()}, nil
+
+	}
+
+	return nil, fmt.Errorf("no informer found for %v", resource)
+}

pkg/client/informers/externalversions/internalinterfaces/factory_interfaces.go

@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package internalinterfaces
+
+import (
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
+)
+
+// NewInformerFunc takes versioned.Interface and time.Duration to return a SharedIndexInformer.
+type NewInformerFunc func(versioned.Interface, time.Duration) cache.SharedIndexInformer
+
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
+type SharedInformerFactory interface {
+	Start(stopCh <-chan struct{})
+	InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer
+}
+
+// TweakListOptionsFunc is a function that transforms a v1.ListOptions.
+type TweakListOptionsFunc func(*v1.ListOptions)

pkg/client/informers/externalversions/servicemesh/interface.go

@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package servicemesh
+
+import (
+	internalinterfaces "kubesphere.io/kubesphere/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/client/informers/externalversions/servicemesh/v1alpha2"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1alpha2 provides access to shared informers for resources in V1alpha2.
+	V1alpha2() v1alpha2.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1alpha2 returns a new v1alpha2.Interface.
+func (g *group) V1alpha2() v1alpha2.Interface {
+	return v1alpha2.New(g.factory, g.namespace, g.tweakListOptions)
+}

pkg/client/informers/externalversions/servicemesh/v1alpha2/interface.go

@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	internalinterfaces "kubesphere.io/kubesphere/pkg/client/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// Strategies returns a StrategyInformer.
+	Strategies() StrategyInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// Strategies returns a StrategyInformer.
+func (v *version) Strategies() StrategyInformer {
+	return &strategyInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}

pkg/client/informers/externalversions/servicemesh/v1alpha2/strategy.go

@@ -0,0 +1,89 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
+	versioned "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
+	internalinterfaces "kubesphere.io/kubesphere/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/client/listers/servicemesh/v1alpha2"
+)
+
+// StrategyInformer provides access to a shared informer and lister for
+// Strategies.
+type StrategyInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha2.StrategyLister
+}
+
+type strategyInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewStrategyInformer constructs a new informer for Strategy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewStrategyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredStrategyInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredStrategyInformer constructs a new informer for Strategy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredStrategyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ServicemeshV1alpha2().Strategies(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ServicemeshV1alpha2().Strategies(namespace).Watch(options)
+			},
+		},
+		&servicemeshv1alpha2.Strategy{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *strategyInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredStrategyInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *strategyInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&servicemeshv1alpha2.Strategy{}, f.defaultInformer)
+}
+
+func (f *strategyInformer) Lister() v1alpha2.StrategyLister {
+	return v1alpha2.NewStrategyLister(f.Informer().GetIndexer())
+}

pkg/client/listers/servicemesh/v1alpha2/expansion_generated.go

@@ -0,0 +1,27 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha2
+
+// StrategyListerExpansion allows custom methods to be added to
+// StrategyLister.
+type StrategyListerExpansion interface{}
+
+// StrategyNamespaceListerExpansion allows custom methods to be added to
+// StrategyNamespaceLister.
+type StrategyNamespaceListerExpansion interface{}

pkg/client/listers/servicemesh/v1alpha2/strategy.go

@@ -0,0 +1,94 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
+)
+
+// StrategyLister helps list Strategies.
+type StrategyLister interface {
+	// List lists all Strategies in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha2.Strategy, err error)
+	// Strategies returns an object that can list and get Strategies.
+	Strategies(namespace string) StrategyNamespaceLister
+	StrategyListerExpansion
+}
+
+// strategyLister implements the StrategyLister interface.
+type strategyLister struct {
+	indexer cache.Indexer
+}
+
+// NewStrategyLister returns a new StrategyLister.
+func NewStrategyLister(indexer cache.Indexer) StrategyLister {
+	return &strategyLister{indexer: indexer}
+}
+
+// List lists all Strategies in the indexer.
+func (s *strategyLister) List(selector labels.Selector) (ret []*v1alpha2.Strategy, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha2.Strategy))
+	})
+	return ret, err
+}
+
+// Strategies returns an object that can list and get Strategies.
+func (s *strategyLister) Strategies(namespace string) StrategyNamespaceLister {
+	return strategyNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// StrategyNamespaceLister helps list and get Strategies.
+type StrategyNamespaceLister interface {
+	// List lists all Strategies in the indexer for a given namespace.
+	List(selector labels.Selector) (ret []*v1alpha2.Strategy, err error)
+	// Get retrieves the Strategy from the indexer for a given namespace and name.
+	Get(name string) (*v1alpha2.Strategy, error)
+	StrategyNamespaceListerExpansion
+}
+
+// strategyNamespaceLister implements the StrategyNamespaceLister
+// interface.
+type strategyNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all Strategies in the indexer for a given namespace.
+func (s strategyNamespaceLister) List(selector labels.Selector) (ret []*v1alpha2.Strategy, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha2.Strategy))
+	})
+	return ret, err
+}
+
+// Get retrieves the Strategy from the indexer for a given namespace and name.
+func (s strategyNamespaceLister) Get(name string) (*v1alpha2.Strategy, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha2.Resource("strategy"), name)
+	}
+	return obj.(*v1alpha2.Strategy), nil
+}

pkg/controller/add_strategy.go

@@ -18,6 +18,7 @@ package controller
 
 import (
 	"kubesphere.io/kubesphere/pkg/controller/strategy"
+	"sigs.k8s.io/application/pkg/controller/application"
 )
 
 func init() {
@@ -25,6 +26,6 @@ func init() {
 	AddToManagerFuncs = append(AddToManagerFuncs, strategy.Add)
 
 	// Add application to manager functions
-	//AddToManagerFuncs = append(AddToManagerFuncs, application.Add)
+	AddToManagerFuncs = append(AddToManagerFuncs, application.Add)
 
 }

pkg/controller/destinationrule/destinationrule_controller.go

@@ -0,0 +1,370 @@
+package destinationrule
+
+import (
+	"fmt"
+	"github.com/knative/pkg/apis/istio/v1alpha3"
+	appsv1 "k8s.io/api/apps/v1"
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/types"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/kubernetes/scheme"
+	v1core "k8s.io/client-go/kubernetes/typed/core/v1"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/util/metrics"
+	"kubesphere.io/kubesphere/pkg/controller/virtualservice/util"
+	"reflect"
+	logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
+
+	istioclientset "github.com/knative/pkg/client/clientset/versioned"
+	istioinformers "github.com/knative/pkg/client/informers/externalversions/istio/v1alpha3"
+	istiolisters "github.com/knative/pkg/client/listers/istio/v1alpha3"
+	informersv1 "k8s.io/client-go/informers/apps/v1"
+	coreinformers "k8s.io/client-go/informers/core/v1"
+	clientset "k8s.io/client-go/kubernetes"
+	listersv1 "k8s.io/client-go/listers/apps/v1"
+	corelisters "k8s.io/client-go/listers/core/v1"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/util/workqueue"
+	"time"
+)
+
+const (
+	// maxRetries is the number of times a service will be retried before it is dropped out of the queue.
+	// With the current rate-limiter in use (5ms*2^(maxRetries-1)) the following numbers represent the
+	// sequence of delays between successive queuings of a service.
+	//
+	// 5ms, 10ms, 20ms, 40ms, 80ms, 160ms, 320ms, 640ms, 1.3s, 2.6s, 5.1s, 10.2s, 20.4s, 41s, 82s
+	maxRetries = 15
+)
+
+var log = logf.Log.WithName("destinationrule-controller")
+
+type DestinationRuleController struct {
+	client clientset.Interface
+
+	destinationRuleClient istioclientset.Interface
+
+	eventBroadcaster record.EventBroadcaster
+	eventRecorder    record.EventRecorder
+
+	serviceLister corelisters.ServiceLister
+	serviceSynced cache.InformerSynced
+
+	deploymentLister listersv1.DeploymentLister
+	deploymentSynced cache.InformerSynced
+
+	destinationRuleLister istiolisters.DestinationRuleLister
+	destinationRuleSynced cache.InformerSynced
+
+	queue workqueue.RateLimitingInterface
+
+	workerLoopPeriod time.Duration
+}
+
+func NewDestinationRuleController(deploymentInformer informersv1.DeploymentInformer,
+	destinationRuleInformer istioinformers.DestinationRuleInformer,
+	serviceInformer coreinformers.ServiceInformer,
+	client clientset.Interface,
+	destinationRuleClient istioclientset.Interface) *DestinationRuleController {
+
+	broadcaster := record.NewBroadcaster()
+	broadcaster.StartLogging(log.Info)
+	broadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: client.CoreV1().Events("")})
+	recorder := broadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "destinationrule-controller"})
+
+	if client != nil && client.CoreV1().RESTClient().GetRateLimiter() != nil {
+		metrics.RegisterMetricAndTrackRateLimiterUsage("virtualservice_controller", client.CoreV1().RESTClient().GetRateLimiter())
+	}
+
+	v := &DestinationRuleController{
+		client:                client,
+		destinationRuleClient: destinationRuleClient,
+		queue:                 workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "destinationrule"),
+		workerLoopPeriod:      time.Second,
+	}
+
+	v.deploymentLister = deploymentInformer.Lister()
+	v.deploymentSynced = deploymentInformer.Informer().HasSynced
+
+	deploymentInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    v.addDeployment,
+		DeleteFunc: v.deleteDeployment,
+	})
+
+	v.serviceLister = serviceInformer.Lister()
+	v.serviceSynced = serviceInformer.Informer().HasSynced
+
+	serviceInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    v.enqueueService,
+		DeleteFunc: v.enqueueService,
+		UpdateFunc: func(old, cur interface{}) {
+			v.enqueueService(cur)
+		},
+	})
+
+	v.destinationRuleLister = destinationRuleInformer.Lister()
+	v.destinationRuleSynced = destinationRuleInformer.Informer().HasSynced
+
+	v.eventBroadcaster = broadcaster
+	v.eventRecorder = recorder
+
+	return v
+
+}
+
+func (v *DestinationRuleController) Start(stopCh <-chan struct{}) error {
+	v.Run(5, stopCh)
+
+	return nil
+}
+
+func (v *DestinationRuleController) Run(workers int, stopCh <-chan struct{}) {
+	defer utilruntime.HandleCrash()
+	defer v.queue.ShutDown()
+
+	log.Info("starting destinationrule controller")
+	defer log.Info("shutting down destinationrule controller")
+
+	if !controller.WaitForCacheSync("destinationrule-controller", stopCh, v.serviceSynced, v.destinationRuleSynced, v.deploymentSynced) {
+		return
+	}
+
+	for i := 0; i < workers; i++ {
+		go wait.Until(v.worker, v.workerLoopPeriod, stopCh)
+	}
+
+	go func() {
+		defer utilruntime.HandleCrash()
+	}()
+
+	<-stopCh
+}
+
+func (v *DestinationRuleController) enqueueService(obj interface{}) {
+	key, err := controller.KeyFunc(obj)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("couldn't get key for object %+v: %v", obj, err))
+		return
+	}
+
+	v.queue.Add(key)
+}
+
+func (v *DestinationRuleController) worker() {
+	for v.processNextWorkItem() {
+
+	}
+}
+
+func (v *DestinationRuleController) processNextWorkItem() bool {
+	eKey, quit := v.queue.Get()
+	if quit {
+		return false
+	}
+
+	defer v.queue.Done(eKey)
+
+	err := v.syncService(eKey.(string))
+	v.handleErr(err, eKey)
+
+	return true
+}
+
+func (v *DestinationRuleController) syncService(key string) error {
+	startTime := time.Now()
+	defer func() {
+		log.V(4).Info("Finished syncing service destinationrule.", "key", key, "duration", time.Since(startTime))
+	}()
+
+	namespace, name, err := cache.SplitMetaNamespaceKey(key)
+	if err != nil {
+		return err
+	}
+
+	service, err := v.serviceLister.Services(namespace).Get(name)
+	if err != nil {
+		// Delete the corresponding destinationrule, as the service has been deleted.
+		err = v.destinationRuleClient.NetworkingV1alpha3().DestinationRules(namespace).Delete(name, nil)
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+
+		return nil
+	}
+
+	if len(service.Labels) < len(util.ApplicationLabels) || !util.IsApplicationComponent(&service.ObjectMeta) ||
+		len(service.Spec.Ports) == 0 {
+		// services don't have enough labels to create a virtualservice
+		// or they don't have necessary labels
+		// or they don't have any ports defined
+		return nil
+	}
+
+	deployments, err := v.deploymentLister.Deployments(namespace).List(labels.Set(service.Spec.Selector).AsSelectorPreValidated())
+	if err != nil {
+		return err
+	}
+
+	subsets := []v1alpha3.Subset{}
+	for _, deployment := range deployments {
+
+		version := util.GetComponentVersion(&deployment.ObjectMeta)
+
+		if len(version) == 0 {
+			log.V(4).Info("Deployment doesn't have a version label", "key", types.NamespacedName{Namespace: deployment.Namespace, Name: deployment.Name}.String())
+			continue
+		}
+
+		subset := v1alpha3.Subset{
+			Name: util.NormalizeVersionName(name),
+			Labels: map[string]string{
+				util.VersionLabel: name,
+			},
+		}
+
+		subsets = append(subsets, subset)
+	}
+
+	currentDestinationRule, err := v.destinationRuleLister.DestinationRules(namespace).Get(name)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			currentDestinationRule = &v1alpha3.DestinationRule{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   service.Name,
+					Labels: service.Labels,
+				},
+			}
+		}
+		log.Error(err, "Couldn't get destinationrule for service", "key", key)
+		return err
+	}
+
+	createDestinationRule := len(currentDestinationRule.Spec.Subsets) == 0
+
+	if !createDestinationRule && reflect.DeepEqual(currentDestinationRule.Spec.Subsets, subsets) &&
+		reflect.DeepEqual(currentDestinationRule.Labels, service.Labels) {
+		log.V(5).Info("destinationrule are equal, skipping update", "key", types.NamespacedName{Namespace: service.Namespace, Name: service.Name}.String())
+		return nil
+	}
+
+	newDestinationRule := currentDestinationRule.DeepCopy()
+	newDestinationRule.Spec.Subsets = subsets
+	newDestinationRule.Labels = service.Labels
+	if newDestinationRule.Annotations == nil {
+		newDestinationRule.Annotations = make(map[string]string)
+	}
+
+	if createDestinationRule {
+		_, err = v.destinationRuleClient.NetworkingV1alpha3().DestinationRules(namespace).Create(newDestinationRule)
+	} else {
+		_, err = v.destinationRuleClient.NetworkingV1alpha3().DestinationRules(namespace).Update(newDestinationRule)
+	}
+
+	if err != nil {
+		if createDestinationRule && errors.IsForbidden(err) {
+			// A request is forbidden primarily for two reasons:
+			// 1. namespace is terminating, endpoint creation is not allowed by default.
+			// 2. policy is misconfigured, in which case no service would function anywhere.
+			// Given the frequency of 1, we log at a lower level.
+			log.V(5).Info("Forbidden from creating endpoints", "error", err)
+		}
+
+		if createDestinationRule {
+			v.eventRecorder.Eventf(newDestinationRule, v1.EventTypeWarning, "FailedToCreateDestinationRule", "Failed to create destinationrule for service %v/%v: %v", service.Namespace, service.Name, err)
+		} else {
+			v.eventRecorder.Eventf(newDestinationRule, v1.EventTypeWarning, "FailedToUpdateDestinationRule", "Failed to update destinationrule for service %v/%v: %v", service.Namespace, service.Name, err)
+		}
+
+		return err
+	}
+
+	return nil
+}
+
+// When a destinationrule is added, figure out which service it will be used
+// and enqueue it. obj must have *appsv1.Deployment type
+func (v *DestinationRuleController) addDeployment(obj interface{}) {
+	deploy := obj.(*appsv1.Deployment)
+	services, err := v.getDeploymentServiceMemberShip(deploy)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("unable to get deployment %s/%s's service memberships", deploy.Namespace, deploy.Name))
+		return
+	}
+
+	for key := range services {
+		v.queue.Add(key)
+	}
+
+	return
+}
+
+func (v *DestinationRuleController) deleteDeployment(obj interface{}) {
+	if _, ok := obj.(*appsv1.Deployment); ok {
+		v.addDeployment(obj)
+		return
+	}
+
+	tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
+	if !ok {
+		utilruntime.HandleError(fmt.Errorf("couldn't get object from tombstone %#v", obj))
+		return
+	}
+
+	deploy, ok := tombstone.Obj.(*appsv1.Deployment)
+	if !ok {
+		utilruntime.HandleError(fmt.Errorf("tombstone contained object that is not a deployment %#v", obj))
+		return
+	}
+
+	v.addDeployment(deploy)
+}
+
+func (v *DestinationRuleController) getDeploymentServiceMemberShip(deployment *appsv1.Deployment) (sets.String, error) {
+	set := sets.String{}
+
+	allServices, err := v.serviceLister.Services(deployment.Namespace).List(labels.Everything())
+	if err != nil {
+		return set, err
+	}
+
+	for i := range allServices {
+		service := allServices[i]
+		if service.Spec.Selector == nil {
+			// services with nil selectors match nothing, not everything.
+			continue
+		}
+		selector := labels.Set(service.Spec.Selector).AsSelectorPreValidated()
+		if selector.Matches(labels.Set(deployment.Spec.Selector.MatchLabels)) {
+			key, err := controller.KeyFunc(service)
+			if err != nil {
+				return nil, err
+			}
+			set.Insert(key)
+		}
+	}
+
+	return set, nil
+}
+
+func (v *DestinationRuleController) handleErr(err error, key interface{}) {
+	if err != nil {
+		v.queue.Forget(key)
+		return
+	}
+
+	if v.queue.NumRequeues(key) < maxRetries {
+		log.V(2).Info("Error syncing virtualservice for service, retrying.", "key", key, "error", err)
+		v.queue.AddRateLimited(key)
+		return
+	}
+
+	log.V(0).Info("Dropping service out of the queue", "key", key, "error", err)
+	v.queue.Forget(key)
+	utilruntime.HandleError(err)
+}

pkg/controller/destinationrule/destinationrule_controller_test.go

@@ -0,0 +1 @@
+package destinationrule

pkg/controller/strategy/helper.go

@@ -0,0 +1,42 @@
+package strategy
+
+import (
+	"fmt"
+	"github.com/knative/pkg/apis/istio/v1alpha3"
+	"k8s.io/api/core/v1"
+	"kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
+)
+
+const (
+	AppLabel = "app"
+)
+
+func getAppNameByStrategy(strategy *v1alpha2.Strategy) string {
+	if len(strategy.Labels) > 0 && len(strategy.Labels[AppLabel]) > 0 {
+		return strategy.Labels[AppLabel]
+	}
+	return ""
+}
+
+func fillDestinationPort(vs *v1alpha3.VirtualService, service *v1.Service) error {
+
+	if len(service.Spec.Ports) == 0 {
+		return fmt.Errorf("service %s/%s spec doesn't canotain any ports", service.Namespace, service.Name)
+	}
+
+	// fill http port
+	for i := range vs.Spec.Http {
+		for j := range vs.Spec.Http[i].Route {
+			vs.Spec.Http[i].Route[j].Destination.Port.Number = uint32(service.Spec.Ports[0].Port)
+		}
+	}
+
+	// fill tcp port
+	for i := range vs.Spec.Tcp {
+		for j := range vs.Spec.Tcp[i].Route {
+			vs.Spec.Tcp[i].Route[j].Destination.Port.Number = uint32(service.Spec.Ports[0].Port)
+		}
+	}
+
+	return nil
+}

pkg/controller/strategy/strategy_controller.go

@@ -18,17 +18,17 @@ package strategy
 
 import (
 	"context"
+	"fmt"
 	"github.com/knative/pkg/apis/istio/v1alpha3"
-	"reflect"
-
+	"k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
+	"reflect"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
@@ -36,7 +36,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/source"
 )
 
-var log = logf.Log.WithName("controller")
+var log = logf.Log.WithName("strategy-controller")
 
 // Add creates a new Strategy Controller and adds it to the Manager with default RBAC. The Manager will set fields on the Controller
 // and Start it when the Manager is Started.
@@ -62,10 +62,6 @@ func add(mgr manager.Manager, r reconcile.Reconciler) error {
 	if err != nil {
 		return err
 	}
-	err = c.Watch(&source.Kind{Type: &v1alpha3.VirtualService{}}, &handler.EnqueueRequestForObject{})
-	if err != nil {
-		return err
-	}
 
 	// TODO(user): Modify this to be the types you create
 	// Watch a VirtualService created by Strategy
@@ -97,32 +93,33 @@ type ReconcileStrategy struct {
 // +kubebuilder:rbac:groups=servicemesh.kubesphere.io,resources=strategies,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=servicemesh.kubesphere.io,resources=strategies/status,verbs=get;update;patch
 func (r *ReconcileStrategy) Reconcile(request reconcile.Request) (reconcile.Result, error) {
+
 	// Fetch the Strategy instance
 	strategy := &servicemeshv1alpha2.Strategy{}
 	err := r.Get(context.TODO(), request.NamespacedName, strategy)
+
 	if err != nil {
 		if errors.IsNotFound(err) {
-			// Object not found, return.  Created objects are automatically garbage collected.
-			// For additional cleanup logic use finalizers.
 			return reconcile.Result{}, nil
 		}
-		// Error reading the object - requeue the request.
 		return reconcile.Result{}, err
 	}
 
-	// Define VirtualService to be created
-	vs := &v1alpha3.VirtualService{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      strategy.Name + "-virtualservice",
-			Namespace: strategy.Namespace,
-			Labels:    strategy.Spec.Selector.MatchLabels,
-		},
-		Spec: strategy.Spec.Template.Spec,
+	return r.reconcileStrategy(strategy)
+}
+
+func (r *ReconcileStrategy) reconcileStrategy(strategy *servicemeshv1alpha2.Strategy) (reconcile.Result, error) {
+
+	appName := getAppNameByStrategy(strategy)
+	service := &v1.Service{}
+
+	err := r.Get(context.TODO(), types.NamespacedName{Namespace: strategy.Namespace, Name: appName}, service)
+	if err != nil {
+		log.Error(err, "couldn't find service %s/%s,", strategy.Namespace, appName)
+		return reconcile.Result{}, errors.NewBadRequest(fmt.Sprintf("service %s not found", appName))
 	}
 
-	if err := controllerutil.SetControllerReference(strategy, vs, r.scheme); err != nil {
-		return reconcile.Result{}, err
-	}
+	vs, err := r.generateVirtualService(strategy, service)
 
 	// Check if the VirtualService already exists
 	found := &v1alpha3.VirtualService{}
@@ -130,14 +127,16 @@ func (r *ReconcileStrategy) Reconcile(request reconcile.Request) (reconcile.Resu
 	if err != nil && errors.IsNotFound(err) {
 		log.Info("Creating VirtualService", "namespace", vs.Namespace, "name", vs.Name)
 		err = r.Create(context.TODO(), vs)
+
 		return reconcile.Result{}, err
 	} else if err != nil {
 		return reconcile.Result{}, err
 	}
 
 	// Update the found object and write the result back if there are any changes
-	if !reflect.DeepEqual(vs.Spec, found.Spec) {
+	if !reflect.DeepEqual(vs.Spec, found.Spec) || len(vs.OwnerReferences) == 0 {
 		found.Spec = vs.Spec
+		found.OwnerReferences = vs.OwnerReferences
 		log.Info("Updating VirtualService", "namespace", vs.Namespace, "name", vs.Name)
 		err = r.Update(context.TODO(), found)
 		if err != nil {
@@ -146,3 +145,48 @@ func (r *ReconcileStrategy) Reconcile(request reconcile.Request) (reconcile.Resu
 	}
 	return reconcile.Result{}, nil
 }
+
+func (r *ReconcileStrategy) generateVirtualService(strategy *servicemeshv1alpha2.Strategy, service *v1.Service) (*v1alpha3.VirtualService, error) {
+
+	// Define VirtualService to be created
+	vs := &v1alpha3.VirtualService{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      getAppNameByStrategy(strategy),
+			Namespace: strategy.Namespace,
+			Labels:    strategy.Spec.Selector.MatchLabels,
+		},
+		Spec: strategy.Spec.Template.Spec,
+	}
+
+	// one version rules them all
+	if len(strategy.Spec.GovernorVersion) > 0 {
+
+		governorDestinationWeight := v1alpha3.DestinationWeight{
+			Destination: v1alpha3.Destination{
+				Host:   getAppNameByStrategy(strategy),
+				Subset: strategy.Spec.GovernorVersion,
+			},
+			Weight: 100,
+		}
+
+		if len(strategy.Spec.Template.Spec.Http) > 0 {
+			governorRoute := v1alpha3.HTTPRoute{
+				Route: []v1alpha3.DestinationWeight{governorDestinationWeight},
+			}
+
+			vs.Spec.Http = []v1alpha3.HTTPRoute{governorRoute}
+		} else if len(strategy.Spec.Template.Spec.Tcp) > 0 {
+			governorRoute := v1alpha3.TCPRoute{
+				Route: []v1alpha3.DestinationWeight{governorDestinationWeight},
+			}
+			vs.Spec.Tcp = []v1alpha3.TCPRoute{governorRoute}
+		}
+
+	}
+
+	if err := fillDestinationPort(vs, service); err != nil {
+		return nil, err
+	}
+
+	return vs, nil
+}

pkg/controller/strategy/strategy_controller_test.go

@@ -19,6 +19,7 @@ package strategy
 import (
 	"github.com/knative/pkg/apis/istio/common/v1alpha1"
 	"github.com/knative/pkg/apis/istio/v1alpha3"
+	"k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/util/json"
 	"testing"
 	"time"
@@ -37,23 +38,47 @@ import (
 var c client.Client
 
 var expectedRequest = reconcile.Request{NamespacedName: types.NamespacedName{Name: "foo", Namespace: "default"}}
-var depKey = types.NamespacedName{Name: "foo-virtualservice", Namespace: "default"}
+var depKey = types.NamespacedName{Name: "details", Namespace: "default"}
 
 const timeout = time.Second * 5
 
+var labels = map[string]string{
+	"app.kubernetes.io/name":            "details",
+	"app.kubernetes.io/version":         "v1",
+	"app":                               "details",
+	"servicemesh.kubesphere.io/enabled": "",
+}
+
+var svc = v1.Service{
+	ObjectMeta: metav1.ObjectMeta{
+		Name:      "details",
+		Namespace: "default",
+		Labels:    labels,
+	},
+	Spec: v1.ServiceSpec{
+		Ports: []v1.ServicePort{
+			{
+				Name:     "http",
+				Port:     8080,
+				Protocol: v1.ProtocolTCP,
+			},
+		},
+		Selector: labels,
+	},
+}
+
 func TestReconcile(t *testing.T) {
 	g := gomega.NewGomegaWithT(t)
 	instance := &servicemeshv1alpha2.Strategy{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "foo",
 			Namespace: "default",
+			Labels:    labels,
 		},
 		Spec: servicemeshv1alpha2.StrategySpec{
 			Type: servicemeshv1alpha2.CanaryType,
 			Selector: &metav1.LabelSelector{
-				MatchLabels: map[string]string{
-					"type": "Canary",
-				},
+				MatchLabels: labels,
 			},
 			Template: servicemeshv1alpha2.VirtualServiceTemplateSpec{
 				Spec: v1alpha3.VirtualServiceSpec{
@@ -111,6 +136,14 @@ func TestReconcile(t *testing.T) {
 		mgrStopped.Wait()
 	}()
 
+	err = c.Create(context.TODO(), &svc)
+	if apierrors.IsInvalid(err) {
+		t.Logf("failed to create service, %v", err)
+		return
+	}
+	g.Expect(err).NotTo(gomega.HaveOccurred())
+	//defer c.Delete(context.TODO(), &svc)
+
 	// Create the Strategy object and expect the Reconcile and Deployment to be created
 	err = c.Create(context.TODO(), instance)
 	// The instance object may not be a valid object because it might be missing some required fields.
@@ -119,6 +152,7 @@ func TestReconcile(t *testing.T) {
 		t.Logf("failed to create object, got an invalid object error: %v", err)
 		return
 	}
+
 	g.Expect(err).NotTo(gomega.HaveOccurred())
 	defer c.Delete(context.TODO(), instance)
 	g.Eventually(requests, timeout).Should(gomega.Receive(gomega.Equal(expectedRequest)))
@@ -133,11 +167,11 @@ func TestReconcile(t *testing.T) {
 
 	// Delete the Deployment and expect Reconcile to be called for Deployment deletion
 	g.Expect(c.Delete(context.TODO(), vs)).NotTo(gomega.HaveOccurred())
-	g.Eventually(requests, timeout).Should(gomega.Receive(gomega.Equal(expectedRequest)))
+	//g.Eventually(requests, timeout).Should(gomega.Receive(gomega.Equal(expectedRequest)))
 	//g.Eventually(func() error { return c.Get(context.TODO(), depKey, vs) }, timeout).Should(gomega.Succeed())
 
 	// Manually delete Deployment since GC isn't enabled in the test control plane
 	g.Eventually(func() error { return c.Delete(context.TODO(), vs) }, timeout).
-		Should(gomega.MatchError("virtualservices.networking.istio.io \"foo-virtualservice\" not found"))
+		Should(gomega.MatchError("virtualservices.networking.istio.io \"details\" not found"))
 
 }

pkg/controller/virtualservice/util/util.go

@@ -0,0 +1,72 @@
+package util
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"strings"
+)
+
+const (
+	AppLabel                = "app"
+	VersionLabel            = "version"
+	ApplicationNameLabel    = "app.kubernetes.io/name"
+	ApplicationVersionLabel = "app.kubernetes.io/version"
+	ServiceMeshEnabledLabel = "servicemesh.kubesphere.io/enabled"
+)
+
+// resource with these following labels considered as part of servicemesh
+var ApplicationLabels = [...]string{
+	ApplicationNameLabel,
+	ApplicationVersionLabel,
+	ServiceMeshEnabledLabel,
+	AppLabel,
+}
+
+var TrimChars = [...]string{".", "_", "-"}
+
+// normalize version names
+// strip [_.-]
+func NormalizeVersionName(version string) string {
+	for _, char := range TrimChars {
+		version = strings.ReplaceAll(version, char, "")
+	}
+	return version
+}
+
+func GetComponentName(meta *metav1.ObjectMeta) string {
+	if len(meta.Labels[AppLabel]) > 0 {
+		return meta.Labels[AppLabel]
+	}
+	return ""
+}
+
+func GetComponentVersion(meta *metav1.ObjectMeta) string {
+	if len(meta.Labels[VersionLabel]) > 0 {
+		return meta.Labels[VersionLabel]
+	}
+	return ""
+}
+
+func ExtractApplicationLabels(meta *metav1.ObjectMeta) map[string]string {
+
+	labels := make(map[string]string, 0)
+	for _, label := range ApplicationLabels {
+		if len(meta.Labels[label]) == 0 {
+			return nil
+		} else {
+			labels[label] = meta.Labels[label]
+		}
+	}
+
+	return labels
+}
+
+func IsApplicationComponent(meta *metav1.ObjectMeta) bool {
+
+	for _, label := range ApplicationLabels {
+		if len(meta.Labels[label]) == 0 {
+			return false
+		}
+	}
+
+	return true
+}

pkg/controller/virtualservice/virtualservice_controller.go

@@ -0,0 +1,349 @@
+package virtualservice
+
+import (
+	"fmt"
+	"github.com/knative/pkg/apis/istio/v1alpha3"
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/kubernetes/scheme"
+	v1core "k8s.io/client-go/kubernetes/typed/core/v1"
+	"k8s.io/kubernetes/pkg/controller"
+	"k8s.io/kubernetes/pkg/util/metrics"
+	"kubesphere.io/kubesphere/pkg/controller/virtualservice/util"
+	"strings"
+
+	logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
+
+	istioclient "github.com/knative/pkg/client/clientset/versioned"
+	istioinformers "github.com/knative/pkg/client/informers/externalversions/istio/v1alpha3"
+	istiolisters "github.com/knative/pkg/client/listers/istio/v1alpha3"
+	coreinformers "k8s.io/client-go/informers/core/v1"
+	clientset "k8s.io/client-go/kubernetes"
+	corelisters "k8s.io/client-go/listers/core/v1"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/client-go/util/workqueue"
+	servicemeshinformers "kubesphere.io/kubesphere/pkg/client/informers/externalversions/servicemesh/v1alpha2"
+	servicemeshlisters "kubesphere.io/kubesphere/pkg/client/listers/servicemesh/v1alpha2"
+
+	"time"
+)
+
+const (
+	// maxRetries is the number of times a service will be retried before it is dropped out of the queue.
+	// With the current rate-limiter in use (5ms*2^(maxRetries-1)) the following numbers represent the
+	// sequence of delays between successive queuings of a service.
+	//
+	// 5ms, 10ms, 20ms, 40ms, 80ms, 160ms, 320ms, 640ms, 1.3s, 2.6s, 5.1s, 10.2s, 20.4s, 41s, 82s
+	maxRetries = 15
+)
+
+var log = logf.Log.WithName("virtualservice-controller")
+
+type VirtualServiceController struct {
+	client clientset.Interface
+
+	virtualServiceClient istioclient.Interface
+
+	eventBroadcaster record.EventBroadcaster
+	eventRecorder    record.EventRecorder
+
+	serviceLister corelisters.ServiceLister
+	serviceSynced cache.InformerSynced
+
+	virtualServiceLister istiolisters.VirtualServiceLister
+	virtualServiceSynced cache.InformerSynced
+
+	destinationRuleLister istiolisters.DestinationRuleLister
+	destinationRuleSynced cache.InformerSynced
+
+	strategyLister servicemeshlisters.StrategyLister
+	strategySynced cache.InformerSynced
+
+	queue workqueue.RateLimitingInterface
+
+	workerLoopPeriod time.Duration
+}
+
+func NewVirtualServiceController(serviceInformer coreinformers.ServiceInformer,
+	virtualServiceInformer istioinformers.VirtualServiceInformer,
+	destinationRuleInformer istioinformers.DestinationRuleInformer,
+	strategyInformer servicemeshinformers.StrategyInformer,
+	client clientset.Interface,
+	virtualServiceClient istioclient.Interface) *VirtualServiceController {
+
+	broadcaster := record.NewBroadcaster()
+	broadcaster.StartLogging(log.Info)
+	broadcaster.StartRecordingToSink(&v1core.EventSinkImpl{Interface: client.CoreV1().Events("")})
+	recorder := broadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "virtualservice-controller"})
+
+	if client != nil && client.CoreV1().RESTClient().GetRateLimiter() != nil {
+		metrics.RegisterMetricAndTrackRateLimiterUsage("virtualservice_controller", client.CoreV1().RESTClient().GetRateLimiter())
+	}
+
+	v := &VirtualServiceController{
+		client:               client,
+		virtualServiceClient: virtualServiceClient,
+		queue:                workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "virtualservice"),
+		workerLoopPeriod:     time.Second,
+	}
+
+	serviceInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    v.enqueueService,
+		DeleteFunc: v.enqueueService,
+		UpdateFunc: func(old, cur interface{}) {
+			v.enqueueService(cur)
+		},
+	})
+
+	v.serviceLister = serviceInformer.Lister()
+	v.serviceSynced = serviceInformer.Informer().HasSynced
+
+	v.strategyLister = strategyInformer.Lister()
+	v.strategySynced = strategyInformer.Informer().HasSynced
+
+	strategyInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		DeleteFunc: v.deleteStrategy,
+	})
+
+	v.destinationRuleLister = destinationRuleInformer.Lister()
+	v.destinationRuleSynced = destinationRuleInformer.Informer().HasSynced
+
+	destinationRuleInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc: v.addDestinationRule,
+	})
+
+	v.virtualServiceLister = virtualServiceInformer.Lister()
+	v.virtualServiceSynced = virtualServiceInformer.Informer().HasSynced
+
+	v.eventBroadcaster = broadcaster
+	v.eventRecorder = recorder
+
+	return v
+
+}
+
+func (v *VirtualServiceController) Start(stopCh <-chan struct{}) error {
+	v.Run(5, stopCh)
+	return nil
+}
+
+func (v *VirtualServiceController) Run(workers int, stopCh <-chan struct{}) {
+	defer utilruntime.HandleCrash()
+	defer v.queue.ShutDown()
+
+	log.Info("starting virtualservice controller")
+	defer log.Info("shutting down virtualservice controller")
+
+	if !controller.WaitForCacheSync("virtualservice-controller", stopCh, v.serviceSynced, v.virtualServiceSynced, v.destinationRuleSynced, v.strategySynced) {
+		return
+	}
+
+	for i := 0; i < workers; i++ {
+		go wait.Until(v.worker, v.workerLoopPeriod, stopCh)
+	}
+
+	go func() {
+		defer utilruntime.HandleCrash()
+	}()
+
+	<-stopCh
+}
+
+func (v *VirtualServiceController) enqueueService(obj interface{}) {
+	key, err := controller.KeyFunc(obj)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("couldn't get key for object %+v: %v", obj, err))
+		return
+	}
+
+	v.queue.Add(key)
+}
+
+func (v *VirtualServiceController) worker() {
+
+	for v.processNextWorkItem() {
+	}
+}
+
+func (v *VirtualServiceController) processNextWorkItem() bool {
+	eKey, quit := v.queue.Get()
+	if quit {
+		return false
+	}
+
+	defer v.queue.Done(eKey)
+
+	err := v.syncService(eKey.(string))
+	v.handleErr(err, eKey)
+
+	return true
+}
+
+func (v *VirtualServiceController) syncService(key string) error {
+	startTime := time.Now()
+	defer func() {
+		log.V(4).Info("Finished syncing service virtualservice. ", "service", key, "duration", time.Since(startTime))
+	}()
+
+	namespace, name, err := cache.SplitMetaNamespaceKey(key)
+	if err != nil {
+		return err
+	}
+
+	service, err := v.serviceLister.Services(namespace).Get(name)
+	if err != nil {
+		// Delete the corresponding virtualservice, as the service has been deleted.
+		err = v.virtualServiceClient.NetworkingV1alpha3().VirtualServices(namespace).Delete(service.Name, nil)
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+
+		return nil
+	}
+
+	if len(service.Labels) < len(util.ApplicationLabels) || !util.IsApplicationComponent(&service.ObjectMeta) ||
+		len(service.Spec.Ports) == 0 {
+		// services don't have enough labels to create a virtualservice
+		// or they don't have necessary labels
+		// or they don't have any ports defined
+		return nil
+	}
+
+	vs, err := v.virtualServiceLister.VirtualServices(namespace).Get(name)
+	if err == nil {
+		// there already is virtual service there, no need to create another one
+		return nil
+	}
+
+	destinationRule, err := v.destinationRuleLister.DestinationRules(namespace).Get(name)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			// there is no destinationrule for this service
+			// maybe corresponding workloads are not created yet
+			return nil
+		}
+		log.Error(err, "Couldn't get destinationrule for service.", "service", types.NamespacedName{Name: service.Name, Namespace: service.Namespace}.String())
+		return err
+	}
+
+	subsets := destinationRule.Spec.Subsets
+	if len(subsets) == 0 {
+		// destination rule with no subsets, not possibly
+		err = fmt.Errorf("find destinationrule with no subsets for service %s", name)
+		log.Error(err, "Find destinationrule with no subsets for service", "service", service.String())
+		return err
+	} else {
+		vs = &v1alpha3.VirtualService{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      name,
+				Namespace: namespace,
+				Labels:    util.ExtractApplicationLabels(&service.ObjectMeta),
+			},
+			Spec: v1alpha3.VirtualServiceSpec{
+				Hosts: []string{name},
+			},
+		}
+
+		// check if service has TCP protocol ports
+		for _, port := range service.Spec.Ports {
+			var route v1alpha3.DestinationWeight
+			if port.Protocol == v1.ProtocolTCP {
+				route = v1alpha3.DestinationWeight{
+					Destination: v1alpha3.Destination{
+						Host:   name,
+						Subset: subsets[0].Name,
+						Port: v1alpha3.PortSelector{
+							Number: uint32(port.Port),
+						},
+					},
+					Weight: 100,
+				}
+
+				// a http port, add to HTTPRoute
+				if len(port.Name) > 0 && (port.Name == "http" || strings.HasPrefix(port.Name, "http-")) {
+					vs.Spec.Http = []v1alpha3.HTTPRoute{{Route: []v1alpha3.DestinationWeight{route}}}
+					break
+				}
+
+				// everything else treated as TCPRoute
+				vs.Spec.Tcp = []v1alpha3.TCPRoute{{Route: []v1alpha3.DestinationWeight{route}}}
+			}
+		}
+
+		if len(vs.Spec.Http) > 0 || len(vs.Spec.Tcp) > 0 {
+			_, err := v.virtualServiceClient.NetworkingV1alpha3().VirtualServices(namespace).Create(vs)
+			if err != nil {
+
+				v.eventRecorder.Eventf(vs, v1.EventTypeWarning, "FailedToCreateVirtualService", "Failed to create virtualservice for service %v/%v: %v", service.Namespace, service.Name, err)
+
+				log.Error(err, "create virtualservice for service failed.", "service", service)
+				return err
+			}
+		} else {
+			log.Info("service doesn't have a tcp port.")
+			return nil
+		}
+
+	}
+
+	return nil
+}
+
+// When a destinationrule is added, figure out which service it will be used
+// and enqueue it. obj must have *v1alpha3.DestinationRule type
+func (v *VirtualServiceController) addDestinationRule(obj interface{}) {
+	dr := obj.(*v1alpha3.DestinationRule)
+	service, err := v.serviceLister.Services(dr.Namespace).Get(dr.Name)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			log.V(0).Info("service not created yet", "key", dr.Name)
+			return
+		}
+		utilruntime.HandleError(fmt.Errorf("unable to get service with name %s/%s", dr.Namespace, dr.Name))
+		return
+	}
+
+	_, err = v.virtualServiceLister.VirtualServices(dr.Namespace).Get(dr.Name)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			key, err := controller.KeyFunc(service)
+			if err != nil {
+				utilruntime.HandleError(fmt.Errorf("get service %s/%s key failed", service.Namespace, service.Name))
+				return
+			}
+
+			v.queue.Add(key)
+		}
+	} else {
+		// Already have a virtualservice created.
+	}
+
+	return
+}
+
+func (v *VirtualServiceController) deleteStrategy(obj interface{}) {
+	// nothing to do right now
+
+}
+
+func (v *VirtualServiceController) handleErr(err error, key interface{}) {
+	if err != nil {
+		v.queue.Forget(key)
+		return
+	}
+
+	if v.queue.NumRequeues(key) < maxRetries {
+		log.V(2).Info("Error syncing virtualservice for service retrying.", "key", key, "error", err)
+		v.queue.AddRateLimited(key)
+		return
+	}
+
+	log.V(0).Info("Dropping service %q out of the queue: %v", "key", key, "error", err)
+	v.queue.Forget(key)
+	utilruntime.HandleError(err)
+}

pkg/controller/virtualservice/virtualservice_controller_test.go

@@ -0,0 +1 @@
+package virtualservice

pkg/models/log/constants.go

@@ -27,4 +27,4 @@ const (
 	QueryLevelWorkload
 	QueryLevelPod
 	QueryLevelContainer
-)
+)

pkg/models/log/logcollector.go

@@ -306,4 +306,4 @@ func GetWorkspaceOfNamesapce(namespace string) string {
 	}
 
 	return workspace
-}
+}

pkg/models/log/types.go

@@ -61,4 +61,4 @@ type OutputDBBinding struct {
 	Internal   bool
 	Enable     bool      `gorm:"not null"`
 	Updatetime time.Time `gorm:"not null"`
-}
+}

pkg/models/servicemesh/application.go

@@ -0,0 +1,69 @@
+package servicemesh
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"strings"
+)
+
+const (
+	AppLabel                = "app"
+	VersionLabel            = "version"
+	ApplicationNameLabel    = "app.kubernetes.io/name"
+	ApplicationVersionLabel = "app.kubernetes.io/version"
+)
+
+var ApplicationLabels = [...]string{
+	ApplicationNameLabel,
+	ApplicationVersionLabel,
+	AppLabel,
+}
+
+var TrimChars = [...]string{".", "_", "-"}
+
+// normalize version names
+// strip [_.-]
+func NormalizeVersionName(version string) string {
+	for _, char := range TrimChars {
+		version = strings.ReplaceAll(version, char, "")
+	}
+	return version
+}
+
+func GetComponentName(meta *metav1.ObjectMeta) string {
+	if len(meta.Labels[AppLabel]) > 0 {
+		return meta.Labels[AppLabel]
+	}
+	return ""
+}
+
+func GetComponentVersion(meta *metav1.ObjectMeta) string {
+	if len(meta.Labels[VersionLabel]) > 0 {
+		return meta.Labels[VersionLabel]
+	}
+	return ""
+}
+
+func ExtractApplicationLabels(meta *metav1.ObjectMeta) map[string]string {
+
+	labels := make(map[string]string, 0)
+	for _, label := range ApplicationLabels {
+		if len(meta.Labels[label]) == 0 {
+			return nil
+		} else {
+			labels[label] = meta.Labels[label]
+		}
+	}
+
+	return labels
+}
+
+func IsApplicationComponent(meta *metav1.ObjectMeta) bool {
+
+	for _, label := range ApplicationLabels {
+		if len(meta.Labels[label]) == 0 {
+			return false
+		}
+	}
+
+	return true
+}

pkg/simple/client/prometheus/prometheusclient.go

@@ -18,6 +18,7 @@
 package prometheus
 
 import (
+	"flag"
 	"io/ioutil"
 	"net/http"
 	"net/url"
@@ -25,8 +26,6 @@ import (
 	"strings"
 	"time"
 
-	"os"
-
 	"github.com/emicklei/go-restful"
 	"github.com/golang/glog"
 )
@@ -46,10 +45,7 @@ var PrometheusAPIServer = "prometheus-k8s.kubesphere-monitoring-system.svc"
 var PrometheusAPIEndpoint string
 
 func init() {
-	if env := os.Getenv(PrometheusAPIServerEnv); env != "" {
-		PrometheusAPIServer = env
-	}
-	PrometheusAPIEndpoint = DefaultScheme + "://" + PrometheusAPIServer + ":" + DefaultPrometheusPort + PrometheusApiPath
+	flag.StringVar(&PrometheusAPIEndpoint, "prometheus-endpoint", "http://prometheus-k8s.kubesphere-monitoring-system.svc:9090/api/v1", "")
 }
 
 type MonitoringRequestParams struct {

pkg/simple/controller/namespace/namespaces.go

@@ -85,7 +85,7 @@ func NewNamespaceController(
 	return controller
 }
 
-func (c *NamespaceController) Start(stopCh <-chan struct{}) {
+func (c *NamespaceController) Start(stopCh <-chan struct{}) error {
 	go func() {
 		defer utilruntime.HandleCrash()
 		defer c.workqueue.ShutDown()
@@ -109,6 +109,8 @@ func (c *NamespaceController) Start(stopCh <-chan struct{}) {
 		<-stopCh
 		glog.Info("shutting down workers")
 	}()
+
+	return nil
 }
 
 func (c *NamespaceController) runWorker() {

vendor/github.com/evanphx/json-patch/LICENSE

@@ -0,0 +1,25 @@
+Copyright (c) 2014, Evan Phoenix
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without 
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+* Neither the name of the Evan Phoenix nor the names of its contributors 
+  may be used to endorse or promote products derived from this software 
+  without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE 
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/evanphx/json-patch/merge.go

@@ -0,0 +1,383 @@
+package jsonpatch
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"reflect"
+)
+
+func merge(cur, patch *lazyNode, mergeMerge bool) *lazyNode {
+	curDoc, err := cur.intoDoc()
+
+	if err != nil {
+		pruneNulls(patch)
+		return patch
+	}
+
+	patchDoc, err := patch.intoDoc()
+
+	if err != nil {
+		return patch
+	}
+
+	mergeDocs(curDoc, patchDoc, mergeMerge)
+
+	return cur
+}
+
+func mergeDocs(doc, patch *partialDoc, mergeMerge bool) {
+	for k, v := range *patch {
+		if v == nil {
+			if mergeMerge {
+				(*doc)[k] = nil
+			} else {
+				delete(*doc, k)
+			}
+		} else {
+			cur, ok := (*doc)[k]
+
+			if !ok || cur == nil {
+				pruneNulls(v)
+				(*doc)[k] = v
+			} else {
+				(*doc)[k] = merge(cur, v, mergeMerge)
+			}
+		}
+	}
+}
+
+func pruneNulls(n *lazyNode) {
+	sub, err := n.intoDoc()
+
+	if err == nil {
+		pruneDocNulls(sub)
+	} else {
+		ary, err := n.intoAry()
+
+		if err == nil {
+			pruneAryNulls(ary)
+		}
+	}
+}
+
+func pruneDocNulls(doc *partialDoc) *partialDoc {
+	for k, v := range *doc {
+		if v == nil {
+			delete(*doc, k)
+		} else {
+			pruneNulls(v)
+		}
+	}
+
+	return doc
+}
+
+func pruneAryNulls(ary *partialArray) *partialArray {
+	newAry := []*lazyNode{}
+
+	for _, v := range *ary {
+		if v != nil {
+			pruneNulls(v)
+			newAry = append(newAry, v)
+		}
+	}
+
+	*ary = newAry
+
+	return ary
+}
+
+var errBadJSONDoc = fmt.Errorf("Invalid JSON Document")
+var errBadJSONPatch = fmt.Errorf("Invalid JSON Patch")
+var errBadMergeTypes = fmt.Errorf("Mismatched JSON Documents")
+
+// MergeMergePatches merges two merge patches together, such that
+// applying this resulting merged merge patch to a document yields the same
+// as merging each merge patch to the document in succession.
+func MergeMergePatches(patch1Data, patch2Data []byte) ([]byte, error) {
+	return doMergePatch(patch1Data, patch2Data, true)
+}
+
+// MergePatch merges the patchData into the docData.
+func MergePatch(docData, patchData []byte) ([]byte, error) {
+	return doMergePatch(docData, patchData, false)
+}
+
+func doMergePatch(docData, patchData []byte, mergeMerge bool) ([]byte, error) {
+	doc := &partialDoc{}
+
+	docErr := json.Unmarshal(docData, doc)
+
+	patch := &partialDoc{}
+
+	patchErr := json.Unmarshal(patchData, patch)
+
+	if _, ok := docErr.(*json.SyntaxError); ok {
+		return nil, errBadJSONDoc
+	}
+
+	if _, ok := patchErr.(*json.SyntaxError); ok {
+		return nil, errBadJSONPatch
+	}
+
+	if docErr == nil && *doc == nil {
+		return nil, errBadJSONDoc
+	}
+
+	if patchErr == nil && *patch == nil {
+		return nil, errBadJSONPatch
+	}
+
+	if docErr != nil || patchErr != nil {
+		// Not an error, just not a doc, so we turn straight into the patch
+		if patchErr == nil {
+			if mergeMerge {
+				doc = patch
+			} else {
+				doc = pruneDocNulls(patch)
+			}
+		} else {
+			patchAry := &partialArray{}
+			patchErr = json.Unmarshal(patchData, patchAry)
+
+			if patchErr != nil {
+				return nil, errBadJSONPatch
+			}
+
+			pruneAryNulls(patchAry)
+
+			out, patchErr := json.Marshal(patchAry)
+
+			if patchErr != nil {
+				return nil, errBadJSONPatch
+			}
+
+			return out, nil
+		}
+	} else {
+		mergeDocs(doc, patch, mergeMerge)
+	}
+
+	return json.Marshal(doc)
+}
+
+// resemblesJSONArray indicates whether the byte-slice "appears" to be
+// a JSON array or not.
+// False-positives are possible, as this function does not check the internal
+// structure of the array. It only checks that the outer syntax is present and
+// correct.
+func resemblesJSONArray(input []byte) bool {
+	input = bytes.TrimSpace(input)
+
+	hasPrefix := bytes.HasPrefix(input, []byte("["))
+	hasSuffix := bytes.HasSuffix(input, []byte("]"))
+
+	return hasPrefix && hasSuffix
+}
+
+// CreateMergePatch will return a merge patch document capable of converting
+// the original document(s) to the modified document(s).
+// The parameters can be bytes of either two JSON Documents, or two arrays of
+// JSON documents.
+// The merge patch returned follows the specification defined at http://tools.ietf.org/html/draft-ietf-appsawg-json-merge-patch-07
+func CreateMergePatch(originalJSON, modifiedJSON []byte) ([]byte, error) {
+	originalResemblesArray := resemblesJSONArray(originalJSON)
+	modifiedResemblesArray := resemblesJSONArray(modifiedJSON)
+
+	// Do both byte-slices seem like JSON arrays?
+	if originalResemblesArray && modifiedResemblesArray {
+		return createArrayMergePatch(originalJSON, modifiedJSON)
+	}
+
+	// Are both byte-slices are not arrays? Then they are likely JSON objects...
+	if !originalResemblesArray && !modifiedResemblesArray {
+		return createObjectMergePatch(originalJSON, modifiedJSON)
+	}
+
+	// None of the above? Then return an error because of mismatched types.
+	return nil, errBadMergeTypes
+}
+
+// createObjectMergePatch will return a merge-patch document capable of
+// converting the original document to the modified document.
+func createObjectMergePatch(originalJSON, modifiedJSON []byte) ([]byte, error) {
+	originalDoc := map[string]interface{}{}
+	modifiedDoc := map[string]interface{}{}
+
+	err := json.Unmarshal(originalJSON, &originalDoc)
+	if err != nil {
+		return nil, errBadJSONDoc
+	}
+
+	err = json.Unmarshal(modifiedJSON, &modifiedDoc)
+	if err != nil {
+		return nil, errBadJSONDoc
+	}
+
+	dest, err := getDiff(originalDoc, modifiedDoc)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(dest)
+}
+
+// createArrayMergePatch will return an array of merge-patch documents capable
+// of converting the original document to the modified document for each
+// pair of JSON documents provided in the arrays.
+// Arrays of mismatched sizes will result in an error.
+func createArrayMergePatch(originalJSON, modifiedJSON []byte) ([]byte, error) {
+	originalDocs := []json.RawMessage{}
+	modifiedDocs := []json.RawMessage{}
+
+	err := json.Unmarshal(originalJSON, &originalDocs)
+	if err != nil {
+		return nil, errBadJSONDoc
+	}
+
+	err = json.Unmarshal(modifiedJSON, &modifiedDocs)
+	if err != nil {
+		return nil, errBadJSONDoc
+	}
+
+	total := len(originalDocs)
+	if len(modifiedDocs) != total {
+		return nil, errBadJSONDoc
+	}
+
+	result := []json.RawMessage{}
+	for i := 0; i < len(originalDocs); i++ {
+		original := originalDocs[i]
+		modified := modifiedDocs[i]
+
+		patch, err := createObjectMergePatch(original, modified)
+		if err != nil {
+			return nil, err
+		}
+
+		result = append(result, json.RawMessage(patch))
+	}
+
+	return json.Marshal(result)
+}
+
+// Returns true if the array matches (must be json types).
+// As is idiomatic for go, an empty array is not the same as a nil array.
+func matchesArray(a, b []interface{}) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	if (a == nil && b != nil) || (a != nil && b == nil) {
+		return false
+	}
+	for i := range a {
+		if !matchesValue(a[i], b[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// Returns true if the values matches (must be json types)
+// The types of the values must match, otherwise it will always return false
+// If two map[string]interface{} are given, all elements must match.
+func matchesValue(av, bv interface{}) bool {
+	if reflect.TypeOf(av) != reflect.TypeOf(bv) {
+		return false
+	}
+	switch at := av.(type) {
+	case string:
+		bt := bv.(string)
+		if bt == at {
+			return true
+		}
+	case float64:
+		bt := bv.(float64)
+		if bt == at {
+			return true
+		}
+	case bool:
+		bt := bv.(bool)
+		if bt == at {
+			return true
+		}
+	case nil:
+		// Both nil, fine.
+		return true
+	case map[string]interface{}:
+		bt := bv.(map[string]interface{})
+		for key := range at {
+			if !matchesValue(at[key], bt[key]) {
+				return false
+			}
+		}
+		for key := range bt {
+			if !matchesValue(at[key], bt[key]) {
+				return false
+			}
+		}
+		return true
+	case []interface{}:
+		bt := bv.([]interface{})
+		return matchesArray(at, bt)
+	}
+	return false
+}
+
+// getDiff returns the (recursive) difference between a and b as a map[string]interface{}.
+func getDiff(a, b map[string]interface{}) (map[string]interface{}, error) {
+	into := map[string]interface{}{}
+	for key, bv := range b {
+		av, ok := a[key]
+		// value was added
+		if !ok {
+			into[key] = bv
+			continue
+		}
+		// If types have changed, replace completely
+		if reflect.TypeOf(av) != reflect.TypeOf(bv) {
+			into[key] = bv
+			continue
+		}
+		// Types are the same, compare values
+		switch at := av.(type) {
+		case map[string]interface{}:
+			bt := bv.(map[string]interface{})
+			dst := make(map[string]interface{}, len(bt))
+			dst, err := getDiff(at, bt)
+			if err != nil {
+				return nil, err
+			}
+			if len(dst) > 0 {
+				into[key] = dst
+			}
+		case string, float64, bool:
+			if !matchesValue(av, bv) {
+				into[key] = bv
+			}
+		case []interface{}:
+			bt := bv.([]interface{})
+			if !matchesArray(at, bt) {
+				into[key] = bv
+			}
+		case nil:
+			switch bv.(type) {
+			case nil:
+				// Both nil, fine.
+			default:
+				into[key] = bv
+			}
+		default:
+			panic(fmt.Sprintf("Unknown type:%T in key %s", av, key))
+		}
+	}
+	// Now add all deleted values as nil
+	for key := range a {
+		_, found := b[key]
+		if !found {
+			into[key] = nil
+		}
+	}
+	return into, nil
+}

vendor/github.com/evanphx/json-patch/patch.go

@@ -0,0 +1,682 @@
+package jsonpatch
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+const (
+	eRaw = iota
+	eDoc
+	eAry
+)
+
+var SupportNegativeIndices bool = true
+
+type lazyNode struct {
+	raw   *json.RawMessage
+	doc   partialDoc
+	ary   partialArray
+	which int
+}
+
+type operation map[string]*json.RawMessage
+
+// Patch is an ordered collection of operations.
+type Patch []operation
+
+type partialDoc map[string]*lazyNode
+type partialArray []*lazyNode
+
+type container interface {
+	get(key string) (*lazyNode, error)
+	set(key string, val *lazyNode) error
+	add(key string, val *lazyNode) error
+	remove(key string) error
+}
+
+func newLazyNode(raw *json.RawMessage) *lazyNode {
+	return &lazyNode{raw: raw, doc: nil, ary: nil, which: eRaw}
+}
+
+func (n *lazyNode) MarshalJSON() ([]byte, error) {
+	switch n.which {
+	case eRaw:
+		return json.Marshal(n.raw)
+	case eDoc:
+		return json.Marshal(n.doc)
+	case eAry:
+		return json.Marshal(n.ary)
+	default:
+		return nil, fmt.Errorf("Unknown type")
+	}
+}
+
+func (n *lazyNode) UnmarshalJSON(data []byte) error {
+	dest := make(json.RawMessage, len(data))
+	copy(dest, data)
+	n.raw = &dest
+	n.which = eRaw
+	return nil
+}
+
+func (n *lazyNode) intoDoc() (*partialDoc, error) {
+	if n.which == eDoc {
+		return &n.doc, nil
+	}
+
+	if n.raw == nil {
+		return nil, fmt.Errorf("Unable to unmarshal nil pointer as partial document")
+	}
+
+	err := json.Unmarshal(*n.raw, &n.doc)
+
+	if err != nil {
+		return nil, err
+	}
+
+	n.which = eDoc
+	return &n.doc, nil
+}
+
+func (n *lazyNode) intoAry() (*partialArray, error) {
+	if n.which == eAry {
+		return &n.ary, nil
+	}
+
+	if n.raw == nil {
+		return nil, fmt.Errorf("Unable to unmarshal nil pointer as partial array")
+	}
+
+	err := json.Unmarshal(*n.raw, &n.ary)
+
+	if err != nil {
+		return nil, err
+	}
+
+	n.which = eAry
+	return &n.ary, nil
+}
+
+func (n *lazyNode) compact() []byte {
+	buf := &bytes.Buffer{}
+
+	if n.raw == nil {
+		return nil
+	}
+
+	err := json.Compact(buf, *n.raw)
+
+	if err != nil {
+		return *n.raw
+	}
+
+	return buf.Bytes()
+}
+
+func (n *lazyNode) tryDoc() bool {
+	if n.raw == nil {
+		return false
+	}
+
+	err := json.Unmarshal(*n.raw, &n.doc)
+
+	if err != nil {
+		return false
+	}
+
+	n.which = eDoc
+	return true
+}
+
+func (n *lazyNode) tryAry() bool {
+	if n.raw == nil {
+		return false
+	}
+
+	err := json.Unmarshal(*n.raw, &n.ary)
+
+	if err != nil {
+		return false
+	}
+
+	n.which = eAry
+	return true
+}
+
+func (n *lazyNode) equal(o *lazyNode) bool {
+	if n.which == eRaw {
+		if !n.tryDoc() && !n.tryAry() {
+			if o.which != eRaw {
+				return false
+			}
+
+			return bytes.Equal(n.compact(), o.compact())
+		}
+	}
+
+	if n.which == eDoc {
+		if o.which == eRaw {
+			if !o.tryDoc() {
+				return false
+			}
+		}
+
+		if o.which != eDoc {
+			return false
+		}
+
+		for k, v := range n.doc {
+			ov, ok := o.doc[k]
+
+			if !ok {
+				return false
+			}
+
+			if v == nil && ov == nil {
+				continue
+			}
+
+			if !v.equal(ov) {
+				return false
+			}
+		}
+
+		return true
+	}
+
+	if o.which != eAry && !o.tryAry() {
+		return false
+	}
+
+	if len(n.ary) != len(o.ary) {
+		return false
+	}
+
+	for idx, val := range n.ary {
+		if !val.equal(o.ary[idx]) {
+			return false
+		}
+	}
+
+	return true
+}
+
+func (o operation) kind() string {
+	if obj, ok := o["op"]; ok && obj != nil {
+		var op string
+
+		err := json.Unmarshal(*obj, &op)
+
+		if err != nil {
+			return "unknown"
+		}
+
+		return op
+	}
+
+	return "unknown"
+}
+
+func (o operation) path() string {
+	if obj, ok := o["path"]; ok && obj != nil {
+		var op string
+
+		err := json.Unmarshal(*obj, &op)
+
+		if err != nil {
+			return "unknown"
+		}
+
+		return op
+	}
+
+	return "unknown"
+}
+
+func (o operation) from() string {
+	if obj, ok := o["from"]; ok && obj != nil {
+		var op string
+
+		err := json.Unmarshal(*obj, &op)
+
+		if err != nil {
+			return "unknown"
+		}
+
+		return op
+	}
+
+	return "unknown"
+}
+
+func (o operation) value() *lazyNode {
+	if obj, ok := o["value"]; ok {
+		return newLazyNode(obj)
+	}
+
+	return nil
+}
+
+func isArray(buf []byte) bool {
+Loop:
+	for _, c := range buf {
+		switch c {
+		case ' ':
+		case '\n':
+		case '\t':
+			continue
+		case '[':
+			return true
+		default:
+			break Loop
+		}
+	}
+
+	return false
+}
+
+func findObject(pd *container, path string) (container, string) {
+	doc := *pd
+
+	split := strings.Split(path, "/")
+
+	if len(split) < 2 {
+		return nil, ""
+	}
+
+	parts := split[1 : len(split)-1]
+
+	key := split[len(split)-1]
+
+	var err error
+
+	for _, part := range parts {
+
+		next, ok := doc.get(decodePatchKey(part))
+
+		if next == nil || ok != nil {
+			return nil, ""
+		}
+
+		if isArray(*next.raw) {
+			doc, err = next.intoAry()
+
+			if err != nil {
+				return nil, ""
+			}
+		} else {
+			doc, err = next.intoDoc()
+
+			if err != nil {
+				return nil, ""
+			}
+		}
+	}
+
+	return doc, decodePatchKey(key)
+}
+
+func (d *partialDoc) set(key string, val *lazyNode) error {
+	(*d)[key] = val
+	return nil
+}
+
+func (d *partialDoc) add(key string, val *lazyNode) error {
+	(*d)[key] = val
+	return nil
+}
+
+func (d *partialDoc) get(key string) (*lazyNode, error) {
+	return (*d)[key], nil
+}
+
+func (d *partialDoc) remove(key string) error {
+	_, ok := (*d)[key]
+	if !ok {
+		return fmt.Errorf("Unable to remove nonexistent key: %s", key)
+	}
+
+	delete(*d, key)
+	return nil
+}
+
+func (d *partialArray) set(key string, val *lazyNode) error {
+	if key == "-" {
+		*d = append(*d, val)
+		return nil
+	}
+
+	idx, err := strconv.Atoi(key)
+	if err != nil {
+		return err
+	}
+
+	sz := len(*d)
+	if idx+1 > sz {
+		sz = idx + 1
+	}
+
+	ary := make([]*lazyNode, sz)
+
+	cur := *d
+
+	copy(ary, cur)
+
+	if idx >= len(ary) {
+		return fmt.Errorf("Unable to access invalid index: %d", idx)
+	}
+
+	ary[idx] = val
+
+	*d = ary
+	return nil
+}
+
+func (d *partialArray) add(key string, val *lazyNode) error {
+	if key == "-" {
+		*d = append(*d, val)
+		return nil
+	}
+
+	idx, err := strconv.Atoi(key)
+	if err != nil {
+		return err
+	}
+
+	ary := make([]*lazyNode, len(*d)+1)
+
+	cur := *d
+
+	if idx >= len(ary) {
+		return fmt.Errorf("Unable to access invalid index: %d", idx)
+	}
+
+	if SupportNegativeIndices {
+		if idx < -len(ary) {
+			return fmt.Errorf("Unable to access invalid index: %d", idx)
+		}
+
+		if idx < 0 {
+			idx += len(ary)
+		}
+	}
+
+	copy(ary[0:idx], cur[0:idx])
+	ary[idx] = val
+	copy(ary[idx+1:], cur[idx:])
+
+	*d = ary
+	return nil
+}
+
+func (d *partialArray) get(key string) (*lazyNode, error) {
+	idx, err := strconv.Atoi(key)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if idx >= len(*d) {
+		return nil, fmt.Errorf("Unable to access invalid index: %d", idx)
+	}
+
+	return (*d)[idx], nil
+}
+
+func (d *partialArray) remove(key string) error {
+	idx, err := strconv.Atoi(key)
+	if err != nil {
+		return err
+	}
+
+	cur := *d
+
+	if idx >= len(cur) {
+		return fmt.Errorf("Unable to access invalid index: %d", idx)
+	}
+
+	if SupportNegativeIndices {
+		if idx < -len(cur) {
+			return fmt.Errorf("Unable to access invalid index: %d", idx)
+		}
+
+		if idx < 0 {
+			idx += len(cur)
+		}
+	}
+
+	ary := make([]*lazyNode, len(cur)-1)
+
+	copy(ary[0:idx], cur[0:idx])
+	copy(ary[idx:], cur[idx+1:])
+
+	*d = ary
+	return nil
+
+}
+
+func (p Patch) add(doc *container, op operation) error {
+	path := op.path()
+
+	con, key := findObject(doc, path)
+
+	if con == nil {
+		return fmt.Errorf("jsonpatch add operation does not apply: doc is missing path: \"%s\"", path)
+	}
+
+	return con.add(key, op.value())
+}
+
+func (p Patch) remove(doc *container, op operation) error {
+	path := op.path()
+
+	con, key := findObject(doc, path)
+
+	if con == nil {
+		return fmt.Errorf("jsonpatch remove operation does not apply: doc is missing path: \"%s\"", path)
+	}
+
+	return con.remove(key)
+}
+
+func (p Patch) replace(doc *container, op operation) error {
+	path := op.path()
+
+	con, key := findObject(doc, path)
+
+	if con == nil {
+		return fmt.Errorf("jsonpatch replace operation does not apply: doc is missing path: %s", path)
+	}
+
+	_, ok := con.get(key)
+	if ok != nil {
+		return fmt.Errorf("jsonpatch replace operation does not apply: doc is missing key: %s", path)
+	}
+
+	return con.set(key, op.value())
+}
+
+func (p Patch) move(doc *container, op operation) error {
+	from := op.from()
+
+	con, key := findObject(doc, from)
+
+	if con == nil {
+		return fmt.Errorf("jsonpatch move operation does not apply: doc is missing from path: %s", from)
+	}
+
+	val, err := con.get(key)
+	if err != nil {
+		return err
+	}
+
+	err = con.remove(key)
+	if err != nil {
+		return err
+	}
+
+	path := op.path()
+
+	con, key = findObject(doc, path)
+
+	if con == nil {
+		return fmt.Errorf("jsonpatch move operation does not apply: doc is missing destination path: %s", path)
+	}
+
+	return con.set(key, val)
+}
+
+func (p Patch) test(doc *container, op operation) error {
+	path := op.path()
+
+	con, key := findObject(doc, path)
+
+	if con == nil {
+		return fmt.Errorf("jsonpatch test operation does not apply: is missing path: %s", path)
+	}
+
+	val, err := con.get(key)
+
+	if err != nil {
+		return err
+	}
+
+	if val == nil {
+		if op.value().raw == nil {
+			return nil
+		}
+		return fmt.Errorf("Testing value %s failed", path)
+	} else if op.value() == nil {
+		return fmt.Errorf("Testing value %s failed", path)
+	}
+
+	if val.equal(op.value()) {
+		return nil
+	}
+
+	return fmt.Errorf("Testing value %s failed", path)
+}
+
+func (p Patch) copy(doc *container, op operation) error {
+	from := op.from()
+
+	con, key := findObject(doc, from)
+
+	if con == nil {
+		return fmt.Errorf("jsonpatch copy operation does not apply: doc is missing from path: %s", from)
+	}
+
+	val, err := con.get(key)
+	if err != nil {
+		return err
+	}
+
+	path := op.path()
+
+	con, key = findObject(doc, path)
+
+	if con == nil {
+		return fmt.Errorf("jsonpatch copy operation does not apply: doc is missing destination path: %s", path)
+	}
+
+	return con.set(key, val)
+}
+
+// Equal indicates if 2 JSON documents have the same structural equality.
+func Equal(a, b []byte) bool {
+	ra := make(json.RawMessage, len(a))
+	copy(ra, a)
+	la := newLazyNode(&ra)
+
+	rb := make(json.RawMessage, len(b))
+	copy(rb, b)
+	lb := newLazyNode(&rb)
+
+	return la.equal(lb)
+}
+
+// DecodePatch decodes the passed JSON document as an RFC 6902 patch.
+func DecodePatch(buf []byte) (Patch, error) {
+	var p Patch
+
+	err := json.Unmarshal(buf, &p)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return p, nil
+}
+
+// Apply mutates a JSON document according to the patch, and returns the new
+// document.
+func (p Patch) Apply(doc []byte) ([]byte, error) {
+	return p.ApplyIndent(doc, "")
+}
+
+// ApplyIndent mutates a JSON document according to the patch, and returns the new
+// document indented.
+func (p Patch) ApplyIndent(doc []byte, indent string) ([]byte, error) {
+	var pd container
+	if doc[0] == '[' {
+		pd = &partialArray{}
+	} else {
+		pd = &partialDoc{}
+	}
+
+	err := json.Unmarshal(doc, pd)
+
+	if err != nil {
+		return nil, err
+	}
+
+	err = nil
+
+	for _, op := range p {
+		switch op.kind() {
+		case "add":
+			err = p.add(&pd, op)
+		case "remove":
+			err = p.remove(&pd, op)
+		case "replace":
+			err = p.replace(&pd, op)
+		case "move":
+			err = p.move(&pd, op)
+		case "test":
+			err = p.test(&pd, op)
+		case "copy":
+			err = p.copy(&pd, op)
+		default:
+			err = fmt.Errorf("Unexpected kind: %s", op.kind())
+		}
+
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if indent != "" {
+		return json.MarshalIndent(pd, "", indent)
+	}
+
+	return json.Marshal(pd)
+}
+
+// From http://tools.ietf.org/html/rfc6901#section-4 :
+//
+// Evaluation of each reference token begins by decoding any escaped
+// character sequence.  This is performed by first transforming any
+// occurrence of the sequence '~1' to '/', and then transforming any
+// occurrence of the sequence '~0' to '~'.
+
+var (
+	rfc6901Decoder = strings.NewReplacer("~1", "/", "~0", "~")
+)
+
+func decodePatchKey(k string) string {
+	return rfc6901Decoder.Replace(k)
+}

vendor/github.com/kiali/kiali/graph/options/options.go

@@ -3,14 +3,12 @@ package options
 
 import (
 	"fmt"
-	"net/http"
+	"github.com/emicklei/go-restful"
 	"net/url"
 	"strconv"
 	"strings"
 	"time"
 
-	"github.com/gorilla/mux"
-
 	"github.com/kiali/kiali/business"
 	"github.com/kiali/kiali/graph"
 	"github.com/kiali/kiali/graph/appender"
@@ -64,17 +62,26 @@ type Options struct {
 	VendorOptions
 }
 
-func NewOptions(r *http.Request) Options {
+func getParameters(key string, request *restful.Request) string {
+	value, ok := request.PathParameters()[key]
+
+	if !ok {
+		return request.QueryParameter(key)
+	}
+
+	return value
+}
+
+func NewOptions(request *restful.Request) Options {
 	// path variables (0 or more will be set)
-	vars := mux.Vars(r)
-	app := vars["app"]
-	namespace := vars["namespace"]
-	service := vars["service"]
-	version := vars["version"]
-	workload := vars["workload"]
+	app := getParameters("app", request)
+	namespace := getParameters("namespace", request)
+	service := getParameters("service", request)
+	version := getParameters("version", request)
+	workload := getParameters("workload", request)
 
 	// query params
-	params := r.URL.Query()
+	params := request.Request.URL.Query()
 	var duration time.Duration
 	var includeIstio bool
 	var injectServiceNodes bool

vendor/github.com/kiali/kiali/handlers/apps.go

@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"github.com/emicklei/go-restful"
 	"net/http"
 
 	"github.com/gorilla/mux"
@@ -61,31 +62,30 @@ func AppDetails(w http.ResponseWriter, r *http.Request) {
 }
 
 // AppMetrics is the API handler to fetch metrics to be displayed, related to an app-label grouping
-func AppMetrics(w http.ResponseWriter, r *http.Request) {
-	getAppMetrics(w, r, defaultPromClientSupplier, defaultK8SClientSupplier)
+func AppMetrics(request *restful.Request, response *restful.Response) {
+	getAppMetrics(request, response, defaultPromClientSupplier, defaultK8SClientSupplier)
 }
 
 // getAppMetrics (mock-friendly version)
-func getAppMetrics(w http.ResponseWriter, r *http.Request, promSupplier promClientSupplier, k8sSupplier k8sClientSupplier) {
-	vars := mux.Vars(r)
-	namespace := vars["namespace"]
-	app := vars["app"]
+func getAppMetrics(request *restful.Request, response *restful.Response, promSupplier promClientSupplier, k8sSupplier k8sClientSupplier) {
+	namespace := request.PathParameters()["namespace"]
+	app := request.PathParameters()["app"]
 
-	prom, _, namespaceInfo := initClientsForMetrics(w, promSupplier, k8sSupplier, namespace)
+	prom, _, namespaceInfo := initClientsForMetrics(response.ResponseWriter, promSupplier, k8sSupplier, namespace)
 	if prom == nil {
 		// any returned value nil means error & response already written
 		return
 	}
 
 	params := prometheus.IstioMetricsQuery{Namespace: namespace, App: app}
-	err := extractIstioMetricsQueryParams(r, &params, namespaceInfo)
+	err := extractIstioMetricsQueryParams(request.Request, &params, namespaceInfo)
 	if err != nil {
-		RespondWithError(w, http.StatusBadRequest, err.Error())
+		RespondWithError(response.ResponseWriter, http.StatusBadRequest, err.Error())
 		return
 	}
 
 	metrics := prom.GetMetrics(&params)
-	RespondWithJSON(w, http.StatusOK, metrics)
+	RespondWithJSON(response.ResponseWriter, http.StatusOK, metrics)
 }
 
 // CustomDashboard is the API handler to fetch runtime metrics to be displayed, related to a single app

vendor/github.com/kiali/kiali/handlers/graph.go

@@ -34,6 +34,7 @@ package handlers
 import (
 	"context"
 	"fmt"
+	"github.com/emicklei/go-restful"
 	"net/http"
 	"runtime/debug"
 	"time"
@@ -51,26 +52,35 @@ import (
 	"github.com/kiali/kiali/prometheus/internalmetrics"
 )
 
-// GraphNamespaces is a REST http.HandlerFunc handling graph generation for 1 or more namespaces
-func GraphNamespaces(w http.ResponseWriter, r *http.Request) {
-	defer handlePanic(w)
+func GetNamespaceGraph(request * restful.Request, response *restful.Response) {
+	defer handlePanic(response.ResponseWriter)
 
 	client, err := prometheus.NewClient()
 	graph.CheckError(err)
 
-	graphNamespaces(w, r, client)
+	graphNamespaces(request, response, client)
+}
+
+// GraphNamespaces is a REST http.HandlerFunc handling graph generation for 1 or more namespaces
+func GraphNamespaces(request *restful.Request, response *restful.Response) {
+	defer handlePanic(response.ResponseWriter)
+
+	client, err := prometheus.NewClient()
+	graph.CheckError(err)
+
+	graphNamespaces(request, response, client)
 }
 
 // graphNamespaces provides a testing hook that can supply a mock client
-func graphNamespaces(w http.ResponseWriter, r *http.Request, client *prometheus.Client) {
-	o := options.NewOptions(r)
+func graphNamespaces(reqeust *restful.Request, response *restful.Response, client *prometheus.Client) {
+	o := options.NewOptions(reqeust)
 
 	// time how long it takes to generate this graph
 	promtimer := internalmetrics.GetGraphGenerationTimePrometheusTimer(o.GetGraphKind(), o.GraphType, o.InjectServiceNodes)
 	defer promtimer.ObserveDuration()
 
 	trafficMap := buildNamespacesTrafficMap(o, client)
-	generateGraph(trafficMap, w, o)
+	generateGraph(trafficMap, response.ResponseWriter, o)
 
 	// update metrics
 	internalmetrics.SetGraphNodes(o.GetGraphKind(), o.GraphType, o.InjectServiceNodes, len(trafficMap))
@@ -613,18 +623,18 @@ func addNode(trafficMap graph.TrafficMap, namespace, workload, app, version, ser
 
 // GraphNode is a REST http.HandlerFunc handling node-detail graph
 // config generation.
-func GraphNode(w http.ResponseWriter, r *http.Request) {
-	defer handlePanic(w)
+func GraphNode(request *restful.Request, response *restful.Response) {
+	defer handlePanic(response.ResponseWriter)
 
 	client, err := prometheus.NewClient()
 	graph.CheckError(err)
 
-	graphNode(w, r, client)
+	graphNode(request, response, client)
 }
 
 // graphNode provides a testing hook that can supply a mock client
-func graphNode(w http.ResponseWriter, r *http.Request, client *prometheus.Client) {
-	o := options.NewOptions(r)
+func graphNode(request *restful.Request, response *restful.Response, client *prometheus.Client) {
+	o := options.NewOptions(request)
 	switch o.Vendor {
 	case "cytoscape":
 	default:
@@ -664,7 +674,7 @@ func graphNode(w http.ResponseWriter, r *http.Request, client *prometheus.Client
 	// the current decision is to not reduce the node graph to provide more detail.  This may be
 	// confusing to users, we'll see...
 
-	generateGraph(trafficMap, w, o)
+	generateGraph(trafficMap, response.ResponseWriter, o)
 
 	// update metrics
 	internalmetrics.SetGraphNodes(o.GetGraphKind(), o.GraphType, o.InjectServiceNodes, len(trafficMap))

vendor/github.com/kiali/kiali/handlers/namespaces.go

@@ -1,10 +1,9 @@
 package handlers
 
 import (
+	"github.com/emicklei/go-restful"
 	"net/http"
 
-	"github.com/gorilla/mux"
-
 	"github.com/kiali/kiali/business"
 	"github.com/kiali/kiali/log"
 	"github.com/kiali/kiali/prometheus"
@@ -31,28 +30,27 @@ func NamespaceList(w http.ResponseWriter, r *http.Request) {
 
 // NamespaceMetrics is the API handler to fetch metrics to be displayed, related to all
 // services in the namespace
-func NamespaceMetrics(w http.ResponseWriter, r *http.Request) {
-	getNamespaceMetrics(w, r, defaultPromClientSupplier, defaultK8SClientSupplier)
+func NamespaceMetrics(request *restful.Request, response *restful.Response) {
+	getNamespaceMetrics(request, response, defaultPromClientSupplier, defaultK8SClientSupplier)
 }
 
 // getServiceMetrics (mock-friendly version)
-func getNamespaceMetrics(w http.ResponseWriter, r *http.Request, promSupplier promClientSupplier, k8sSupplier k8sClientSupplier) {
-	vars := mux.Vars(r)
-	namespace := vars["namespace"]
+func getNamespaceMetrics(request *restful.Request, response *restful.Response, promSupplier promClientSupplier, k8sSupplier k8sClientSupplier) {
+	namespace := request.PathParameters()["namespace"]
 
-	prom, _, namespaceInfo := initClientsForMetrics(w, promSupplier, k8sSupplier, namespace)
+	prom, _, namespaceInfo := initClientsForMetrics(response.ResponseWriter, promSupplier, k8sSupplier, namespace)
 	if prom == nil {
 		// any returned value nil means error & response already written
 		return
 	}
 
 	params := prometheus.IstioMetricsQuery{Namespace: namespace}
-	err := extractIstioMetricsQueryParams(r, &params, namespaceInfo)
+	err := extractIstioMetricsQueryParams(request.Request, &params, namespaceInfo)
 	if err != nil {
-		RespondWithError(w, http.StatusBadRequest, err.Error())
+		RespondWithError(response.ResponseWriter, http.StatusBadRequest, err.Error())
 		return
 	}
 
 	metrics := prom.GetMetrics(&params)
-	RespondWithJSON(w, http.StatusOK, metrics)
+	RespondWithJSON(response.ResponseWriter, http.StatusOK, metrics)
 }

vendor/github.com/kiali/kiali/handlers/services.go

@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"github.com/emicklei/go-restful"
 	"net/http"
 	"sync"
 
@@ -36,31 +37,30 @@ func ServiceList(w http.ResponseWriter, r *http.Request) {
 }
 
 // ServiceMetrics is the API handler to fetch metrics to be displayed, related to a single service
-func ServiceMetrics(w http.ResponseWriter, r *http.Request) {
-	getServiceMetrics(w, r, defaultPromClientSupplier, defaultK8SClientSupplier)
+func ServiceMetrics(request *restful.Request, response *restful.Response) {
+	getServiceMetrics(request, response, defaultPromClientSupplier, defaultK8SClientSupplier)
 }
 
 // getServiceMetrics (mock-friendly version)
-func getServiceMetrics(w http.ResponseWriter, r *http.Request, promSupplier promClientSupplier, k8sSupplier k8sClientSupplier) {
-	vars := mux.Vars(r)
-	namespace := vars["namespace"]
-	service := vars["service"]
+func getServiceMetrics(request *restful.Request, response *restful.Response, promSupplier promClientSupplier, k8sSupplier k8sClientSupplier) {
+	namespace := request.PathParameters()["namespace"]
+	service := request.PathParameters()["service"]
 
-	prom, _, namespaceInfo := initClientsForMetrics(w, promSupplier, k8sSupplier, namespace)
+	prom, _, namespaceInfo := initClientsForMetrics(response.ResponseWriter, promSupplier, k8sSupplier, namespace)
 	if prom == nil {
 		// any returned value nil means error & response already written
 		return
 	}
 
 	params := prometheus.IstioMetricsQuery{Namespace: namespace, Service: service}
-	err := extractIstioMetricsQueryParams(r, &params, namespaceInfo)
+	err := extractIstioMetricsQueryParams(request.Request, &params, namespaceInfo)
 	if err != nil {
-		RespondWithError(w, http.StatusBadRequest, err.Error())
+		RespondWithError(response.ResponseWriter, http.StatusBadRequest, err.Error())
 		return
 	}
 
 	metrics := prom.GetMetrics(&params)
-	RespondWithJSON(w, http.StatusOK, metrics)
+	RespondWithJSON(response.ResponseWriter, http.StatusOK, metrics)
 }
 
 // ServiceDetails is the API handler to fetch full details of an specific service

vendor/github.com/kiali/kiali/handlers/workloads.go

@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"github.com/emicklei/go-restful"
 	"net/http"
 
 	"github.com/gorilla/mux"
@@ -60,31 +61,30 @@ func WorkloadDetails(w http.ResponseWriter, r *http.Request) {
 }
 
 // WorkloadMetrics is the API handler to fetch metrics to be displayed, related to a single workload
-func WorkloadMetrics(w http.ResponseWriter, r *http.Request) {
-	getWorkloadMetrics(w, r, defaultPromClientSupplier, defaultK8SClientSupplier)
+func WorkloadMetrics(request *restful.Request, response *restful.Response) {
+	getWorkloadMetrics(request, response, defaultPromClientSupplier, defaultK8SClientSupplier)
 }
 
 // getWorkloadMetrics (mock-friendly version)
-func getWorkloadMetrics(w http.ResponseWriter, r *http.Request, promSupplier promClientSupplier, k8sSupplier k8sClientSupplier) {
-	vars := mux.Vars(r)
-	namespace := vars["namespace"]
-	workload := vars["workload"]
+func getWorkloadMetrics(request *restful.Request, response *restful.Response, promSupplier promClientSupplier, k8sSupplier k8sClientSupplier) {
+	namespace := request.PathParameter("namespace")
+	workload := request.PathParameter("workload")
 
-	prom, _, namespaceInfo := initClientsForMetrics(w, promSupplier, k8sSupplier, namespace)
+	prom, _, namespaceInfo := initClientsForMetrics(response.ResponseWriter, promSupplier, k8sSupplier, namespace)
 	if prom == nil {
 		// any returned value nil means error & response already written
 		return
 	}
 
 	params := prometheus.IstioMetricsQuery{Namespace: namespace, Workload: workload}
-	err := extractIstioMetricsQueryParams(r, &params, namespaceInfo)
+	err := extractIstioMetricsQueryParams(request.Request, &params, namespaceInfo)
 	if err != nil {
-		RespondWithError(w, http.StatusBadRequest, err.Error())
+		RespondWithError(response.ResponseWriter, http.StatusBadRequest, err.Error())
 		return
 	}
 
 	metrics := prom.GetMetrics(&params)
-	RespondWithJSON(w, http.StatusOK, metrics)
+	RespondWithJSON(response, http.StatusOK, metrics)
 }
 
 // WorkloadDashboard is the API handler to fetch Istio dashboard, related to a single workload

vendor/github.com/knative/pkg/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

vendor/github.com/knative/pkg/apis/istio/authentication/register.go

@@ -0,0 +1,21 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package authentication
+
+const (
+	GroupName = "authentication.istio.io"
+)

vendor/github.com/knative/pkg/apis/istio/authentication/v1alpha1/doc.go

@@ -0,0 +1,22 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Api versions allow the api contract for a resource to be changed while keeping
+// backward compatibility by support multiple concurrent versions
+// of the same resource
+// +k8s:deepcopy-gen=package
+// +groupName=authentication.istio.io
+package v1alpha1

vendor/github.com/knative/pkg/apis/istio/authentication/v1alpha1/policy_types.go

@@ -0,0 +1,345 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"github.com/knative/pkg/apis/istio/common/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// VirtualService
+type Policy struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              PolicySpec `json:"spec"`
+}
+
+// Policy defines what authentication methods can be accepted on workload(s),
+// and if authenticated, which method/certificate will set the request principal
+// (i.e request.auth.principal attribute).
+//
+// Authentication policy is composed of 2-part authentication:
+// - peer: verify caller service credentials. This part will set source.user
+// (peer identity).
+// - origin: verify the origin credentials. This part will set request.auth.user
+// (origin identity), as well as other attributes like request.auth.presenter,
+// request.auth.audiences and raw claims. Note that the identity could be
+// end-user, service account, device etc.
+//
+// Last but not least, the principal binding rule defines which identity (peer
+// or origin) should be used as principal. By default, it uses peer.
+//
+// Examples:
+//
+// Policy to enable mTLS for all services in namespace frod
+//
+// apiVersion: authentication.istio.io/v1alpha1
+// kind: Policy
+// metadata:
+//   name: mTLS_enable
+//   namespace: frod
+// spec:
+//   peers:
+//   - mtls:
+//
+// Policy to disable mTLS for "productpage" service
+//
+// apiVersion: authentication.istio.io/v1alpha1
+// kind: Policy
+// metadata:
+//   name: mTLS_disable
+//   namespace: frod
+// spec:
+//   targets:
+//   - name: productpage
+//
+// Policy to require mTLS for peer authentication, and JWT for origin authenticationn
+// for productpage:9000. Principal is set from origin identity.
+//
+// apiVersion: authentication.istio.io/v1alpha1
+// kind: Policy
+// metadata:
+//   name: mTLS_enable
+//   namespace: frod
+// spec:
+//   target:
+//   - name: productpage
+//     ports:
+//     - number: 9000
+//   peers:
+//   - mtls:
+//   origins:
+//   - jwt:
+//       issuer: "https://securetoken.google.com"
+//       audiences:
+//       - "productpage"
+//       jwksUri: "https://www.googleapis.com/oauth2/v1/certs"
+//       jwt_headers:
+//       - "x-goog-iap-jwt-assertion"
+//   principaBinding: USE_ORIGIN
+//
+// Policy to require mTLS for peer authentication, and JWT for origin authenticationn
+// for productpage:9000, but allow origin authentication failed. Principal is set
+// from origin identity.
+// Note: this example can be used for use cases when we want to allow request from
+// certain peers, given it comes with an approperiate authorization poicy to check
+// and reject request accoridingly.
+//
+// apiVersion: authentication.istio.io/v1alpha1
+// kind: Policy
+// metadata:
+//   name: mTLS_enable
+//   namespace: frod
+// spec:
+//   target:
+//   - name: productpage
+//     ports:
+//     - number: 9000
+//   peers:
+//   - mtls:
+//   origins:
+//   - jwt:
+//       issuer: "https://securetoken.google.com"
+//       audiences:
+//       - "productpage"
+//       jwksUri: "https://www.googleapis.com/oauth2/v1/certs"
+//       jwt_headers:
+//       - "x-goog-iap-jwt-assertion"
+//   originIsOptional: true
+//   principalBinding: USE_ORIGIN
+type PolicySpec struct {
+	// List rules to select destinations that the policy should be applied on.
+	// If empty, policy will be used on all destinations in the same namespace.
+	Targets []TargetSelector `json:"targets,omitempty"`
+
+	// List of authentication methods that can be used for peer authentication.
+	// They will be evaluated in order; the first validate one will be used to
+	// set peer identity (source.user) and other peer attributes. If none of
+	// these methods pass, and peer_is_optional flag is false (see below),
+	// request will be rejected with authentication failed error (401).
+	// Leave the list empty if peer authentication is not required
+	Peers []PeerAuthenticationMethod `json:"peers,omitempty"`
+
+	// Set this flag to true to accept request (for peer authentication perspective),
+	// even when none of the peer authentication methods defined above satisfied.
+	// Typically, this is used to delay the rejection decision to next layer (e.g
+	// authorization).
+	// This flag is ignored if no authentication defined for peer (peers field is empty).
+	PeerIsOptional bool `json:"peerIsOptional,omitempty"`
+
+	// List of authentication methods that can be used for origin authentication.
+	// Similar to peers, these will be evaluated in order; the first validate one
+	// will be used to set origin identity and attributes (i.e request.auth.user,
+	// request.auth.issuer etc). If none of these methods pass, and origin_is_optional
+	// is false (see below), request will be rejected with authentication failed
+	// error (401).
+	// Leave the list empty if origin authentication is not required.
+	Origins []OriginAuthenticationMethod `json:"origins,omitempty"`
+
+	// Set this flag to true to accept request (for origin authentication perspective),
+	// even when none of the origin authentication methods defined above satisfied.
+	// Typically, this is used to delay the rejection decision to next layer (e.g
+	// authorization).
+	// This flag is ignored if no authentication defined for origin (origins field is empty).
+	OriginIsOptional bool `json:"originIsOptional,omitempty"`
+
+	// Define whether peer or origin identity should be use for principal. Default
+	// value is USE_PEER.
+	// If peer (or origin) identity is not available, either because of peer/origin
+	// authentication is not defined, or failed, principal will be left unset.
+	// In other words, binding rule does not affect the decision to accept or
+	// reject request.
+	PrincipalBinding PrincipalBinding `json:"principalBinding,omitempty"`
+}
+
+// TargetSelector defines a matching rule to a service/destination.
+type TargetSelector struct {
+	// REQUIRED. The name must be a short name from the service registry. The
+	// fully qualified domain name will be resolved in a platform specific manner.
+	Name string `json:"name"`
+
+	// Specifies the ports on the destination. Leave empty to match all ports
+	// that are exposed.
+	Ports []PortSelector `json:"ports,omitempty"`
+}
+
+// PortSelector specifies the name or number of a port to be used for
+// matching targets for authenticationn policy. This is copied from
+// networking API to avoid dependency.
+type PortSelector struct {
+	// It is required to specify exactly one of the fields:
+	// Number or Name
+
+	// Valid port number
+	Number uint32 `json:"number,omitempty"`
+
+	// Port name
+	Name string `json:"name,omitempty"`
+}
+
+// PeerAuthenticationMethod defines one particular type of authentication, e.g
+// mutual TLS, JWT etc, (no authentication is one type by itself) that can
+// be used for peer authentication.
+// The type can be progammatically determine by checking the type of the
+// "params" field.
+type PeerAuthenticationMethod struct {
+	// It is required to specify exactly one of the fields:
+	// Mtls or Jwt
+	// Set if mTLS is used.
+	Mtls *MutualTls `json:"mtls,omitempty"`
+
+	// Set if JWT is used. This option is not yet available.
+	Jwt *Jwt `json:"jwt,omitempty"`
+}
+
+// Defines the acceptable connection TLS mode.
+type Mode string
+
+const (
+	// Client cert must be presented, connection is in TLS.
+	ModeStrict Mode = "STRICT"
+
+	// Connection can be either plaintext or TLS, and client cert can be omitted.
+	ModePermissive Mode = "PERMISSIVE"
+)
+
+// TLS authentication params.
+type MutualTls struct {
+
+	// WILL BE DEPRECATED, if set, will translates to `TLS_PERMISSIVE` mode.
+	// Set this flag to true to allow regular TLS (i.e without client x509
+	// certificate). If request carries client certificate, identity will be
+	// extracted and used (set to peer identity). Otherwise, peer identity will
+	// be left unset.
+	// When the flag is false (default), request must have client certificate.
+	AllowTls bool `json:"allowTls,omitempty"`
+
+	// Defines the mode of mTLS authentication.
+	Mode Mode `json:"mode,omitempty"`
+}
+
+// JSON Web Token (JWT) token format for authentication as defined by
+// https://tools.ietf.org/html/rfc7519. See [OAuth
+// 2.0](https://tools.ietf.org/html/rfc6749) and [OIDC
+// 1.0](http://openid.net/connect) for how this is used in the whole
+// authentication flow.
+//
+// Example,
+//
+// issuer: https://example.com
+// audiences:
+// - bookstore_android.apps.googleusercontent.com
+//   bookstore_web.apps.googleusercontent.com
+// jwksUri: https://example.com/.well-known/jwks.json
+//
+type Jwt struct {
+	// Identifies the issuer that issued the JWT. See
+	// [issuer](https://tools.ietf.org/html/rfc7519#section-4.1.1)
+	// Usually a URL or an email address.
+	//
+	// Example: https://securetoken.google.com
+	// Example: 1234567-compute@developer.gserviceaccount.com
+	Issuer string `json:"issuer,omitempty"`
+
+	// The list of JWT
+	// [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3).
+	// that are allowed to access. A JWT containing any of these
+	// audiences will be accepted.
+	//
+	// The service name will be accepted if audiences is empty.
+	//
+	// Example:
+	//
+	// ```yaml
+	// audiences:
+	// - bookstore_android.apps.googleusercontent.com
+	//   bookstore_web.apps.googleusercontent.com
+	// ```
+	Audiences []string `json:"audiences,omitempty"`
+
+	// URL of the provider's public key set to validate signature of the
+	// JWT. See [OpenID
+	// Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
+	//
+	// Optional if the key set document can either (a) be retrieved from
+	// [OpenID
+	// Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html) of
+	// the issuer or (b) inferred from the email domain of the issuer (e.g. a
+	// Google service account).
+	//
+	// Example: https://www.googleapis.com/oauth2/v1/certs
+	JwksUri string `json:"jwksUri,omitempty"`
+
+	// Two fields below define where to extract the JWT from an HTTP request.
+	//
+	// If no explicit location is specified the following default
+	// locations are tried in order:
+	//
+	//     1) The Authorization header using the Bearer schema,
+	//        e.g. Authorization: Bearer <token>. (see
+	//        [Authorization Request Header
+	//        Field](https://tools.ietf.org/html/rfc6750#section-2.1))
+	//
+	//     2) `access_token` query parameter (see
+	//     [URI Query Parameter](https://tools.ietf.org/html/rfc6750#section-2.3))
+	// JWT is sent in a request header. `header` represents the
+	// header name.
+	//
+	// For example, if `header=x-goog-iap-jwt-assertion`, the header
+	// format will be x-goog-iap-jwt-assertion: <JWT>.
+	JwtHeaders []string `json:"jwtHeaders,omitempty"`
+
+	// JWT is sent in a query parameter. `query` represents the
+	// query parameter name.
+	//
+	// For example, `query=jwt_token`.
+	JwtParams []string `json:"jwtParams,omitempty"`
+
+	// URL paths that should be excluded from the JWT validation. If the request path is matched,
+	// the JWT validation will be skipped and the request will proceed regardless.
+	// This is useful to keep a couple of URLs public for external health checks.
+	// Example: "/health_check", "/status/cpu_usage".
+	ExcludedPaths []v1alpha1.StringMatch `json:"excludedPaths,omitempty"`
+}
+
+// OriginAuthenticationMethod defines authentication method/params for origin
+// authentication. Origin could be end-user, device, delegate service etc.
+// Currently, only JWT is supported for origin authentication.
+type OriginAuthenticationMethod struct {
+	// Jwt params for the method.
+	Jwt *Jwt `json:"jwt,omitempty"`
+}
+
+// Associates authentication with request principal.
+type PrincipalBinding string
+
+const (
+	// Principal will be set to the identity from peer authentication.
+	PrincipalBindingUserPeer PrincipalBinding = "USE_PEER"
+	// Principal will be set to the identity from peer authentication.
+	PrincipalBindingUserOrigin PrincipalBinding = "USE_ORIGIN"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// PolicyLIst is a list of Policy resources
+type PolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+	Items           []Policy `json:"items"`
+}

vendor/github.com/knative/pkg/apis/istio/authentication/v1alpha1/register.go

@@ -0,0 +1,52 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"github.com/knative/pkg/apis/istio/authentication"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: authentication.GroupName, Version: "v1alpha1"}
+
+// Kind takes an unqualified kind and returns back a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Policy{},
+		&PolicyList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}

vendor/github.com/knative/pkg/apis/istio/authentication/v1alpha1/zz_generated.deepcopy.go

@@ -0,0 +1,259 @@
+// +build !ignore_autogenerated
+
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	commonv1alpha1 "github.com/knative/pkg/apis/istio/common/v1alpha1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Jwt) DeepCopyInto(out *Jwt) {
+	*out = *in
+	if in.Audiences != nil {
+		in, out := &in.Audiences, &out.Audiences
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.JwtHeaders != nil {
+		in, out := &in.JwtHeaders, &out.JwtHeaders
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.JwtParams != nil {
+		in, out := &in.JwtParams, &out.JwtParams
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ExcludedPaths != nil {
+		in, out := &in.ExcludedPaths, &out.ExcludedPaths
+		*out = make([]commonv1alpha1.StringMatch, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Jwt.
+func (in *Jwt) DeepCopy() *Jwt {
+	if in == nil {
+		return nil
+	}
+	out := new(Jwt)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MutualTls) DeepCopyInto(out *MutualTls) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutualTls.
+func (in *MutualTls) DeepCopy() *MutualTls {
+	if in == nil {
+		return nil
+	}
+	out := new(MutualTls)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OriginAuthenticationMethod) DeepCopyInto(out *OriginAuthenticationMethod) {
+	*out = *in
+	if in.Jwt != nil {
+		in, out := &in.Jwt, &out.Jwt
+		*out = new(Jwt)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OriginAuthenticationMethod.
+func (in *OriginAuthenticationMethod) DeepCopy() *OriginAuthenticationMethod {
+	if in == nil {
+		return nil
+	}
+	out := new(OriginAuthenticationMethod)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PeerAuthenticationMethod) DeepCopyInto(out *PeerAuthenticationMethod) {
+	*out = *in
+	if in.Mtls != nil {
+		in, out := &in.Mtls, &out.Mtls
+		*out = new(MutualTls)
+		**out = **in
+	}
+	if in.Jwt != nil {
+		in, out := &in.Jwt, &out.Jwt
+		*out = new(Jwt)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerAuthenticationMethod.
+func (in *PeerAuthenticationMethod) DeepCopy() *PeerAuthenticationMethod {
+	if in == nil {
+		return nil
+	}
+	out := new(PeerAuthenticationMethod)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Policy) DeepCopyInto(out *Policy) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Policy.
+func (in *Policy) DeepCopy() *Policy {
+	if in == nil {
+		return nil
+	}
+	out := new(Policy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Policy) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PolicyList) DeepCopyInto(out *PolicyList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Policy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyList.
+func (in *PolicyList) DeepCopy() *PolicyList {
+	if in == nil {
+		return nil
+	}
+	out := new(PolicyList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PolicyList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PolicySpec) DeepCopyInto(out *PolicySpec) {
+	*out = *in
+	if in.Targets != nil {
+		in, out := &in.Targets, &out.Targets
+		*out = make([]TargetSelector, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Peers != nil {
+		in, out := &in.Peers, &out.Peers
+		*out = make([]PeerAuthenticationMethod, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Origins != nil {
+		in, out := &in.Origins, &out.Origins
+		*out = make([]OriginAuthenticationMethod, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicySpec.
+func (in *PolicySpec) DeepCopy() *PolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PolicySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PortSelector) DeepCopyInto(out *PortSelector) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PortSelector.
+func (in *PortSelector) DeepCopy() *PortSelector {
+	if in == nil {
+		return nil
+	}
+	out := new(PortSelector)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TargetSelector) DeepCopyInto(out *TargetSelector) {
+	*out = *in
+	if in.Ports != nil {
+		in, out := &in.Ports, &out.Ports
+		*out = make([]PortSelector, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TargetSelector.
+func (in *TargetSelector) DeepCopy() *TargetSelector {
+	if in == nil {
+		return nil
+	}
+	out := new(TargetSelector)
+	in.DeepCopyInto(out)
+	return out
+}

vendor/github.com/knative/pkg/apis/istio/common/v1alpha1/string.go

@@ -0,0 +1,35 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+// Describes how to match a given string in HTTP headers. Match is
+// case-sensitive.
+type StringMatch struct {
+	// Specified exactly one of the fields below.
+
+	// exact string match
+	Exact string `json:"exact,omitempty"`
+
+	// prefix-based match
+	Prefix string `json:"prefix,omitempty"`
+
+	// suffix-based match.
+	Suffix string `json:"suffix,omitempty"`
+
+	// ECMAscript style regex-based match
+	Regex string `json:"regex,omitempty"`
+}

vendor/github.com/knative/pkg/apis/istio/register.go

@@ -0,0 +1,21 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package istio
+
+const (
+	GroupName = "networking.istio.io"
+)

vendor/github.com/knative/pkg/apis/istio/v1alpha3/destinationrule_types.go

@@ -0,0 +1,547 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// DestinationRule
+type DestinationRule struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              DestinationRuleSpec `json:"spec"`
+}
+
+// DestinationRule defines policies that apply to traffic intended for a
+// service after routing has occurred. These rules specify configuration
+// for load balancing, connection pool size from the sidecar, and outlier
+// detection settings to detect and evict unhealthy hosts from the load
+// balancing pool. For example, a simple load balancing policy for the
+// ratings service would look as follows:
+//
+//
+// apiVersion: networking.istio.io/v1alpha3
+// kind: DestinationRule
+// metadata:
+//   name: bookinfo-ratings
+// spec:
+//   host: ratings.prod.svc.cluster.local
+//   trafficPolicy:
+//     loadBalancer:
+//       simple: LEAST_CONN
+//
+//
+// Version specific policies can be specified by defining a named
+// subset and overriding the settings specified at the service level. The
+// following rule uses a round robin load balancing policy for all traffic
+// going to a subset named testversion that is composed of endpoints (e.g.,
+// pods) with labels (version:v3).
+//
+//
+// apiVersion: networking.istio.io/v1alpha3
+// kind: DestinationRule
+// metadata:
+//   name: bookinfo-ratings
+// spec:
+//   host: ratings.prod.svc.cluster.local
+//   trafficPolicy:
+//     loadBalancer:
+//       simple: LEAST_CONN
+//   subsets:
+//   - name: testversion
+//     labels:
+//       version: v3
+//     trafficPolicy:
+//       loadBalancer:
+//         simple: ROUND_ROBIN
+//
+//
+// **Note:** Policies specified for subsets will not take effect until
+// a route rule explicitly sends traffic to this subset.
+//
+// Traffic policies can be customized to specific ports as well. The
+// following rule uses the least connection load balancing policy for all
+// traffic to port 80, while uses a round robin load balancing setting for
+// traffic to the port 9080.
+//
+//
+// apiVersion: networking.istio.io/v1alpha3
+// kind: DestinationRule
+// metadata:
+//   name: bookinfo-ratings-port
+// spec:
+//   host: ratings.prod.svc.cluster.local
+//   trafficPolicy: # Apply to all ports
+//     portLevelSettings:
+//     - port:
+//         number: 80
+//       loadBalancer:
+//         simple: LEAST_CONN
+//     - port:
+//         number: 9080
+//       loadBalancer:
+//         simple: ROUND_ROBIN
+//
+type DestinationRuleSpec struct {
+	// REQUIRED. The name of a service from the service registry. Service
+	// names are looked up from the platform's service registry (e.g.,
+	// Kubernetes services, Consul services, etc.) and from the hosts
+	// declared by [ServiceEntries](#ServiceEntry). Rules defined for
+	// services that do not exist in the service registry will be ignored.
+	//
+	// *Note for Kubernetes users*: When short names are used (e.g. "reviews"
+	// instead of "reviews.default.svc.cluster.local"), Istio will interpret
+	// the short name based on the namespace of the rule, not the service. A
+	// rule in the "default" namespace containing a host "reviews will be
+	// interpreted as "reviews.default.svc.cluster.local", irrespective of
+	// the actual namespace associated with the reviews service. _To avoid
+	// potential misconfigurations, it is recommended to always use fully
+	// qualified domain names over short names._
+	//
+	// Note that the host field applies to both HTTP and TCP services.
+	Host string `json:"host"`
+
+	// Traffic policies to apply (load balancing policy, connection pool
+	// sizes, outlier detection).
+	TrafficPolicy *TrafficPolicy `json:"trafficPolicy,omitempty"`
+
+	// One or more named sets that represent individual versions of a
+	// service. Traffic policies can be overridden at subset level.
+	Subsets []Subset `json:"subsets,omitempty"`
+}
+
+// Traffic policies to apply for a specific destination, across all
+// destination ports. See DestinationRule for examples.
+type TrafficPolicy struct {
+
+	// Settings controlling the load balancer algorithms.
+	LoadBalancer *LoadBalancerSettings `json:"loadBalancer,omitempty"`
+
+	// Settings controlling the volume of connections to an upstream service
+	ConnectionPool *ConnectionPoolSettings `json:"connectionPool,omitempty"`
+
+	// Settings controlling eviction of unhealthy hosts from the load balancing pool
+	OutlierDetection *OutlierDetection `json:"outlierDetection,omitempty"`
+
+	// TLS related settings for connections to the upstream service.
+	Tls *TLSSettings `json:"tls,omitempty"`
+
+	// Traffic policies specific to individual ports. Note that port level
+	// settings will override the destination-level settings. Traffic
+	// settings specified at the destination-level will not be inherited when
+	// overridden by port-level settings, i.e. default values will be applied
+	// to fields omitted in port-level traffic policies.
+	PortLevelSettings []PortTrafficPolicy `json:"portLevelSettings,omitempty"`
+}
+
+// Traffic policies that apply to specific ports of the service
+type PortTrafficPolicy struct {
+	// Specifies the port name or number of a port on the destination service
+	// on which this policy is being applied.
+	//
+	// Names must comply with DNS label syntax (rfc1035) and therefore cannot
+	// collide with numbers. If there are multiple ports on a service with
+	// the same protocol the names should be of the form <protocol-name>-<DNS
+	// label>.
+	Port PortSelector `json:"port"`
+
+	// Settings controlling the load balancer algorithms.
+	LoadBalancer *LoadBalancerSettings `json:"loadBalancer,omitempty"`
+
+	// Settings controlling the volume of connections to an upstream service
+	ConnectionPool *ConnectionPoolSettings `json:"connectionPool,omitempty"`
+
+	// Settings controlling eviction of unhealthy hosts from the load balancing pool
+	OutlierDetection *OutlierDetection `json:"outlierDetection,omitempty"`
+
+	// TLS related settings for connections to the upstream service.
+	Tls *TLSSettings `json:"tls,omitempty"`
+}
+
+// A subset of endpoints of a service. Subsets can be used for scenarios
+// like A/B testing, or routing to a specific version of a service. Refer
+// to [VirtualService](#VirtualService) documentation for examples of using
+// subsets in these scenarios. In addition, traffic policies defined at the
+// service-level can be overridden at a subset-level. The following rule
+// uses a round robin load balancing policy for all traffic going to a
+// subset named testversion that is composed of endpoints (e.g., pods) with
+// labels (version:v3).
+//
+// apiVersion: networking.istio.io/v1alpha3
+// kind: DestinationRule
+// metadata:
+//   name: bookinfo-ratings
+// spec:
+//   host: ratings.prod.svc.cluster.local
+//   trafficPolicy:
+//     loadBalancer:
+//       simple: LEAST_CONN
+//   subsets:
+//   - name: testversion
+//     labels:
+//       version: v3
+//     trafficPolicy:
+//       loadBalancer:
+//         simple: ROUND_ROBIN
+//
+// **Note:** Policies specified for subsets will not take effect until
+// a route rule explicitly sends traffic to this subset.
+type Subset struct {
+	// REQUIRED. Name of the subset. The service name and the subset name can
+	// be used for traffic splitting in a route rule.
+	Name string `json:"name"`
+
+	// REQUIRED. Labels apply a filter over the endpoints of a service in the
+	// service registry. See route rules for examples of usage.
+	Labels map[string]string `json:"labels"`
+
+	// Traffic policies that apply to this subset. Subsets inherit the
+	// traffic policies specified at the DestinationRule level. Settings
+	// specified at the subset level will override the corresponding settings
+	// specified at the DestinationRule level.
+	TrafficPolicy *TrafficPolicy `json:"trafficPolicy,omitempty"`
+}
+
+// Load balancing policies to apply for a specific destination. See Envoy's
+// load balancing
+// [documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing.html)
+// for more details.
+//
+// For example, the following rule uses a round robin load balancing policy
+// for all traffic going to the ratings service.
+//
+// apiVersion: networking.istio.io/v1alpha3
+// kind: DestinationRule
+// metadata:
+//   name: bookinfo-ratings
+// spec:
+//   host: ratings.prod.svc.cluster.local
+//   trafficPolicy:
+//     loadBalancer:
+//       simple: ROUND_ROBIN
+//
+// The following example sets up sticky sessions for the ratings service
+// hashing-based load balancer for the same ratings service using the
+// the User cookie as the hash key.
+//
+//  apiVersion: networking.istio.io/v1alpha3
+//  kind: DestinationRule
+//  metadata:
+//    name: bookinfo-ratings
+//  spec:
+//    host: ratings.prod.svc.cluster.local
+//    trafficPolicy:
+//      loadBalancer:
+//        consistentHash:
+//          httpCookie:
+//            name: user
+//            ttl: 0s
+type LoadBalancerSettings struct {
+	// It is required to specify exactly one of the fields:
+	// Simple or ConsistentHash
+	Simple         SimpleLB          `json:"simple,omitempty"`
+	ConsistentHash *ConsistentHashLB `json:"consistentHash,omitempty"`
+}
+
+// Standard load balancing algorithms that require no tuning.
+type SimpleLB string
+
+const (
+	// Round Robin policy. Default
+	SimpleLBRoundRobin SimpleLB = "ROUND_ROBIN"
+
+	// The least request load balancer uses an O(1) algorithm which selects
+	// two random healthy hosts and picks the host which has fewer active
+	// requests.
+	SimpleLBLeastConn SimpleLB = "LEAST_CONN"
+
+	// The random load balancer selects a random healthy host. The random
+	// load balancer generally performs better than round robin if no health
+	// checking policy is configured.
+	SimpleLBRandom SimpleLB = "RANDOM"
+
+	// This option will forward the connection to the original IP address
+	// requested by the caller without doing any form of load
+	// balancing. This option must be used with care. It is meant for
+	// advanced use cases. Refer to Original Destination load balancer in
+	// Envoy for further details.
+	SimpleLBPassthrough SimpleLB = "PASSTHROUGH"
+)
+
+// Consistent Hash-based load balancing can be used to provide soft
+// session affinity based on HTTP headers, cookies or other
+// properties. This load balancing policy is applicable only for HTTP
+// connections. The affinity to a particular destination host will be
+// lost when one or more hosts are added/removed from the destination
+// service.
+type ConsistentHashLB struct {
+
+	// It is required to specify exactly one of the fields as hash key:
+	// HttpHeaderName, HttpCookie, or UseSourceIP.
+	// Hash based on a specific HTTP header.
+	HttpHeaderName string `json:"httpHeaderName,omitempty"`
+
+	// Hash based on HTTP cookie.
+	HttpCookie *HTTPCookie `json:"httpCookie,omitempty"`
+
+	// Hash based on the source IP address.
+	UseSourceIp bool `json:"useSourceIp,omitempty"`
+
+	// The minimum number of virtual nodes to use for the hash
+	// ring. Defaults to 1024. Larger ring sizes result in more granular
+	// load distributions. If the number of hosts in the load balancing
+	// pool is larger than the ring size, each host will be assigned a
+	// single virtual node.
+	MinimumRingSize uint64 `json:"minimumRingSize,omitempty"`
+}
+
+// Describes a HTTP cookie that will be used as the hash key for the
+// Consistent Hash load balancer. If the cookie is not present, it will
+// be generated.
+type HTTPCookie struct {
+	// REQUIRED. Name of the cookie.
+	Name string `json:"name"`
+
+	// Path to set for the cookie.
+	Path string `json:"path,omitempty"`
+
+	// REQUIRED. Lifetime of the cookie.
+	Ttl string `json:"ttl"`
+}
+
+// Connection pool settings for an upstream host. The settings apply to
+// each individual host in the upstream service.  See Envoy's [circuit
+// breaker](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/circuit_breaking)
+// for more details. Connection pool settings can be applied at the TCP
+// level as well as at HTTP level.
+//
+// For example, the following rule sets a limit of 100 connections to redis
+// service called myredissrv with a connect timeout of 30ms
+//
+// apiVersion: networking.istio.io/v1alpha3
+// kind: DestinationRule
+// metadata:
+//   name: bookinfo-redis
+// spec:
+//   host: myredissrv.prod.svc.cluster.local
+//   trafficPolicy:
+//     connectionPool:
+//       tcp:
+//         maxConnections: 100
+//         connectTimeout: 30ms
+type ConnectionPoolSettings struct {
+
+	// Settings common to both HTTP and TCP upstream connections.
+	Tcp *TCPSettings `json:"tcp,omitempty"`
+
+	// HTTP connection pool settings.
+	Http *HTTPSettings `json:"http,omitempty"`
+}
+
+// Settings common to both HTTP and TCP upstream connections.
+type TCPSettings struct {
+	// Maximum number of HTTP1 /TCP connections to a destination host.
+	MaxConnections int32 `json:"maxConnections,omitempty"`
+
+	// TCP connection timeout.
+	ConnectTimeout string `json:"connectTimeout,omitempty"`
+}
+
+// Settings applicable to HTTP1.1/HTTP2/GRPC connections.
+type HTTPSettings struct {
+	// Maximum number of pending HTTP requests to a destination. Default 1024.
+	Http1MaxPendingRequests int32 `json:"http1MaxPendingRequests,omitempty"`
+
+	// Maximum number of requests to a backend. Default 1024.
+	Http2MaxRequests int32 `json:"http2MaxRequests,omitempty"`
+
+	// Maximum number of requests per connection to a backend. Setting this
+	// parameter to 1 disables keep alive.
+	MaxRequestsPerConnection int32 `json:"maxRequestsPerConnection,omitempty"`
+
+	// Maximum number of retries that can be outstanding to all hosts in a
+	// cluster at a given time. Defaults to 3.
+	MaxRetries int32 `json:"maxRetries,omitempty"`
+}
+
+// A Circuit breaker implementation that tracks the status of each
+// individual host in the upstream service.  Applicable to both HTTP and
+// TCP services.  For HTTP services, hosts that continually return 5xx
+// errors for API calls are ejected from the pool for a pre-defined period
+// of time. For TCP services, connection timeouts or connection
+// failures to a given host counts as an error when measuring the
+// consecutive errors metric. See Envoy's [outlier
+// detection](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/outlier)
+// for more details.
+//
+// The following rule sets a connection pool size of 100 connections and
+// 1000 concurrent HTTP2 requests, with no more than 10 req/connection to
+// "reviews" service. In addition, it configures upstream hosts to be
+// scanned every 5 mins, such that any host that fails 7 consecutive times
+// with 5XX error code will be ejected for 15 minutes.
+//
+// apiVersion: networking.istio.io/v1alpha3
+// kind: DestinationRule
+// metadata:
+//   name: reviews-cb-policy
+// spec:
+//   host: reviews.prod.svc.cluster.local
+//   trafficPolicy:
+//     connectionPool:
+//       tcp:
+//         maxConnections: 100
+//       http:
+//         http2MaxRequests: 1000
+//         maxRequestsPerConnection: 10
+//     outlierDetection:
+//       consecutiveErrors: 7
+//       interval: 5m
+//       baseEjectionTime: 15m
+type OutlierDetection struct {
+	// Number of errors before a host is ejected from the connection
+	// pool. Defaults to 5. When the upstream host is accessed over HTTP, a
+	// 5xx return code qualifies as an error. When the upstream host is
+	// accessed over an opaque TCP connection, connect timeouts and
+	// connection error/failure events qualify as an error.
+	ConsecutiveErrors int32 `json:"consecutiveErrors,omitempty"`
+
+	// Time interval between ejection sweep analysis. format:
+	// 1h/1m/1s/1ms. MUST BE >=1ms. Default is 10s.
+	Interval string `json:"interval,omitempty"`
+
+	// Minimum ejection duration. A host will remain ejected for a period
+	// equal to the product of minimum ejection duration and the number of
+	// times the host has been ejected. This technique allows the system to
+	// automatically increase the ejection period for unhealthy upstream
+	// servers. format: 1h/1m/1s/1ms. MUST BE >=1ms. Default is 30s.
+	BaseEjectionTime string `json:"baseEjectionTime,omitempty"`
+
+	// Maximum % of hosts in the load balancing pool for the upstream
+	// service that can be ejected. Defaults to 10%.
+	MaxEjectionPercent int32 `json:"maxEjectionPercent,omitempty"`
+}
+
+// SSL/TLS related settings for upstream connections. See Envoy's [TLS
+// context](https://www.envoyproxy.io/docs/envoy/latest/api-v1/cluster_manager/cluster_ssl.html#config-cluster-manager-cluster-ssl)
+// for more details. These settings are common to both HTTP and TCP upstreams.
+//
+// For example, the following rule configures a client to use mutual TLS
+// for connections to upstream database cluster.
+//
+// apiVersion: networking.istio.io/v1alpha3
+// kind: DestinationRule
+// metadata:
+//   name: db-mtls
+// spec:
+//   host: mydbserver.prod.svc.cluster.local
+//   trafficPolicy:
+//     tls:
+//       mode: MUTUAL
+//       clientCertificate: /etc/certs/myclientcert.pem
+//       privateKey: /etc/certs/client_private_key.pem
+//       caCertificates: /etc/certs/rootcacerts.pem
+//
+// The following rule configures a client to use TLS when talking to a
+// foreign service whose domain matches *.foo.com.
+//
+// apiVersion: networking.istio.io/v1alpha3
+// kind: DestinationRule
+// metadata:
+//   name: tls-foo
+// spec:
+//   host: "*.foo.com"
+//   trafficPolicy:
+//     tls:
+//       mode: SIMPLE
+//
+// The following rule configures a client to use Istio mutual TLS when talking
+// to rating services.
+//
+// apiVersion: networking.istio.io/v1alpha3
+// kind: DestinationRule
+// metadata:
+//   name: ratings-istio-mtls
+// spec:
+//   host: ratings.prod.svc.cluster.local
+//   trafficPolicy:
+//     tls:
+//       mode: ISTIO_MUTUAL
+type TLSSettings struct {
+
+	// REQUIRED: Indicates whether connections to this port should be secured
+	// using TLS. The value of this field determines how TLS is enforced.
+	Mode TLSmode `json:"mode"`
+
+	// REQUIRED if mode is `MUTUAL`. The path to the file holding the
+	// client-side TLS certificate to use.
+	// Should be empty if mode is `ISTIO_MUTUAL`.
+	ClientCertificate string `json:"clientCertificate,omitempty"`
+
+	// REQUIRED if mode is `MUTUAL`. The path to the file holding the
+	// client's private key.
+	// Should be empty if mode is `ISTIO_MUTUAL`.
+	PrivateKey string `json:"privateKey,omitempty"`
+
+	// OPTIONAL: The path to the file containing certificate authority
+	// certificates to use in verifying a presented server certificate. If
+	// omitted, the proxy will not verify the server's certificate.
+	// Should be empty if mode is `ISTIO_MUTUAL`.
+	CaCertificates string `json:"caCertificates,omitempty"`
+
+	// A list of alternate names to verify the subject identity in the
+	// certificate. If specified, the proxy will verify that the server
+	// certificate's subject alt name matches one of the specified values.
+	// Should be empty if mode is `ISTIO_MUTUAL`.
+	SubjectAltNames []string `json:"subjectAltNames,omitempty"`
+
+	// SNI string to present to the server during TLS handshake.
+	// Should be empty if mode is `ISTIO_MUTUAL`.
+	Sni string `json:"sni,omitempty"`
+}
+
+// TLS connection mode
+type TLSmode string
+
+const (
+	// Do not setup a TLS connection to the upstream endpoint.
+	TLSmodeDisable TLSmode = "DISABLE"
+
+	// Originate a TLS connection to the upstream endpoint.
+	TLSmodeSimple TLSmode = "SIMPLE"
+
+	// Secure connections to the upstream using mutual TLS by presenting
+	// client certificates for authentication.
+	TLSmodeMutual TLSmode = "MUTUAL"
+
+	// Secure connections to the upstream using mutual TLS by presenting
+	// client certificates for authentication.
+	// Compared to Mutual mode, this mode uses certificates generated
+	// automatically by Istio for mTLS authentication. When this mode is
+	// used, all other fields in `TLSSettings` should be empty.
+	TLSmodeIstioMutual TLSmode = "ISTIO_MUTUAL"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// DestinationRuleList is a list of DestinationRule resources
+type DestinationRuleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+	Items           []DestinationRule `json:"items"`
+}

vendor/github.com/knative/pkg/apis/istio/v1alpha3/doc.go

@@ -0,0 +1,23 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Api versions allow the api contract for a resource to be changed while keeping
+// backward compatibility by support multiple concurrent versions
+// of the same resource
+
+// +k8s:deepcopy-gen=package
+// +groupName=networking.istio.io
+package v1alpha3

vendor/github.com/knative/pkg/apis/istio/v1alpha3/gateway_types.go

@@ -0,0 +1,318 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Gateway describes a load balancer operating at the edge of the mesh
+// receiving incoming or outgoing HTTP/TCP connections. The specification
+// describes a set of ports that should be exposed, the type of protocol to
+// use, SNI configuration for the load balancer, etc.
+//
+// For example, the following gateway spec sets up a proxy to act as a load
+// balancer exposing port 80 and 9080 (http), 443 (https), and port 2379
+// (TCP) for ingress.  The gateway will be applied to the proxy running on
+// a pod with labels "app: my-gateway-controller". While Istio will configure the
+// proxy to listen on these ports, it is the responsibility of the user to
+// ensure that external traffic to these ports are allowed into the mesh.
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: Gateway
+//     metadata:
+//       name: my-gateway
+//     spec:
+//       selector:
+//         app: my-gatweway-controller
+//       servers:
+//       - port:
+//           number: 80
+//           name: http
+//           protocol: HTTP
+//         hosts:
+//         - uk.bookinfo.com
+//         - eu.bookinfo.com
+//         tls:
+//           httpsRedirect: true # sends 302 redirect for http requests
+//       - port:
+//           number: 443
+//           name: https
+//           protocol: HTTPS
+//         hosts:
+//         - uk.bookinfo.com
+//         - eu.bookinfo.com
+//         tls:
+//           mode: SIMPLE #enables HTTPS on this port
+//           serverCertificate: /etc/certs/servercert.pem
+//           privateKey: /etc/certs/privatekey.pem
+//       - port:
+//           number: 9080
+//           name: http-wildcard
+//           protocol: HTTP
+//         # no hosts implies wildcard match
+//       - port:
+//           number: 2379 #to expose internal service via external port 2379
+//           name: mongo
+//           protocol: MONGO
+//
+// The gateway specification above describes the L4-L6 properties of a load
+// balancer. A VirtualService can then be bound to a gateway to control
+// the forwarding of traffic arriving at a particular host or gateway port.
+//
+// For example, the following VirtualService splits traffic for
+// https://uk.bookinfo.com/reviews, https://eu.bookinfo.com/reviews,
+// http://uk.bookinfo.com:9080/reviews, http://eu.bookinfo.com:9080/reviews
+// into two versions (prod and qa) of an internal reviews service on port
+// 9080. In addition, requests containing the cookie user: dev-123 will be
+// sent to special port 7777 in the qa version. The same rule is also
+// applicable inside the mesh for requests to the reviews.prod
+// service. This rule is applicable across ports 443, 9080. Note that
+// http://uk.bookinfo.com gets redirected to https://uk.bookinfo.com
+// (i.e. 80 redirects to 443).
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: bookinfo-rule
+//     spec:
+//       hosts:
+//       - reviews.prod
+//       - uk.bookinfo.com
+//       - eu.bookinfo.com
+//       gateways:
+//       - my-gateway
+//       - mesh # applies to all the sidecars in the mesh
+//       http:
+//       - match:
+//         - headers:
+//             cookie:
+//               user: dev-123
+//         route:
+//         - destination:
+//             port:
+//               number: 7777
+//             name: reviews.qa
+//       - match:
+//           uri:
+//             prefix: /reviews/
+//         route:
+//         - destination:
+//             port:
+//               number: 9080 # can be omitted if its the only port for reviews
+//             name: reviews.prod
+//           weight: 80
+//         - destination:
+//             name: reviews.qa
+//           weight: 20
+//
+// The following VirtualService forwards traffic arriving at (external) port
+// 2379 from 172.17.16.0/24 subnet to internal Mongo server on port 5555. This
+// rule is not applicable internally in the mesh as the gateway list omits
+// the reserved name "mesh".
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: bookinfo-Mongo
+//     spec:
+//       hosts:
+//       - mongosvr #name of Mongo service
+//       gateways:
+//       - my-gateway
+//       tcp:
+//       - match:
+//         - port:
+//             number: 2379
+//           sourceSubnet: "172.17.16.0/24"
+//         route:
+//         - destination:
+//             name: mongo.prod
+//
+type Gateway struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec GatewaySpec `json:"spec"`
+}
+
+type GatewaySpec struct {
+	// REQUIRED: A list of server specifications.
+	Servers []Server `json:"servers"`
+
+	// One or more labels that indicate a specific set of pods/VMs
+	// on which this gateway configuration should be applied.
+	// If no selectors are provided, the gateway will be implemented by
+	// the default istio-ingress controller.
+	Selector map[string]string `json:"selector,omitempty"`
+}
+
+// Server describes the properties of the proxy on a given load balancer port.
+// For example,
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: Gateway
+//     metadata:
+//       name: my-ingress
+//     spec:
+//       selector:
+//         app: my-ingress-controller
+//       servers:
+//       - port:
+//           number: 80
+//           name: http2
+//           protocol: HTTP2
+//
+// Another example
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: Gateway
+//     metadata:
+//       name: my-tcp-ingress
+//     spec:
+//       selector:
+//         app: my-tcp-ingress-controller
+//       servers:
+//       - port:
+//           number: 27018
+//           name: mongo
+//           protocol: MONGO
+//
+// The following is an example of TLS configuration for port 443
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: Gateway
+//     metadata:
+//       name: my-tls-ingress
+//     spec:
+//       selector:
+//         app: my-tls-ingress-controller
+//       servers:
+//       - port:
+//           number: 443
+//           name: https
+//           protocol: HTTPS
+//         tls:
+//           mode: SIMPLE
+//           serverCertificate: /etc/certs/server.pem
+//           privateKey: /etc/certs/privatekey.pem
+//
+type Server struct {
+	// REQUIRED: The Port on which the proxy should listen for incoming
+	// connections
+	Port Port `json:"port"`
+
+	// A list of hosts exposed by this gateway. While
+	// typically applicable to HTTP services, it can also be used for TCP
+	// services using TLS with SNI. Standard DNS wildcard prefix syntax
+	// is permitted.
+	//
+	// A VirtualService that is bound to a gateway must having a matching host
+	// in its default destination. Specifically one of the VirtualService
+	// destination hosts is a strict suffix of a gateway host or
+	// a gateway host is a suffix of one of the VirtualService hosts.
+	Hosts []string `json:"hosts,omitempty"`
+
+	// Set of TLS related options that govern the server's behavior. Use
+	// these options to control if all http requests should be redirected to
+	// https, and the TLS modes to use.
+	TLS *TLSOptions `json:"tls,omitempty"`
+}
+
+type TLSOptions struct {
+	// If set to true, the load balancer will send a 302 redirect for all
+	// http connections, asking the clients to use HTTPS.
+	HttpsRedirect bool `json:"httpsRedirect"`
+
+	// Optional: Indicates whether connections to this port should be
+	// secured using TLS. The value of this field determines how TLS is
+	// enforced.
+	Mode TLSMode `json:"mode,omitempty"`
+
+	// REQUIRED if mode is "SIMPLE" or "MUTUAL". The path to the file
+	// holding the server-side TLS certificate to use.
+	ServerCertificate string `json:"serverCertificate"`
+
+	// REQUIRED if mode is "SIMPLE" or "MUTUAL". The path to the file
+	// holding the server's private key.
+	PrivateKey string `json:"privateKey"`
+
+	// REQUIRED if mode is "MUTUAL". The path to a file containing
+	// certificate authority certificates to use in verifying a presented
+	// client side certificate.
+	CaCertificates string `json:"caCertificates"`
+
+	// A list of alternate names to verify the subject identity in the
+	// certificate presented by the client.
+	SubjectAltNames []string `json:"subjectAltNames"`
+}
+
+// TLS modes enforced by the proxy
+type TLSMode string
+
+const (
+	// If set to "PASSTHROUGH", the proxy will forward the connection
+	// to the upstream server selected based on the SNI string presented
+	// by the client.
+	TLSModePassThrough TLSMode = "PASSTHROUGH"
+
+	// If set to "SIMPLE", the proxy will secure connections with
+	// standard TLS semantics.
+	TLSModeSimple TLSMode = "SIMPLE"
+
+	// If set to "MUTUAL", the proxy will secure connections to the
+	// upstream using mutual TLS by presenting client certificates for
+	// authentication.
+	TLSModeMutual TLSMode = "MUTUAL"
+)
+
+// Port describes the properties of a specific port of a service.
+type Port struct {
+	// REQUIRED: A valid non-negative integer port number.
+	Number int `json:"number"`
+
+	// REQUIRED: The protocol exposed on the port.
+	// MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP.
+	Protocol PortProtocol `json:"protocol"`
+
+	// Label assigned to the port.
+	Name string `json:"name,omitempty"`
+}
+
+type PortProtocol string
+
+const (
+	ProtocolHTTP  PortProtocol = "HTTP"
+	ProtocolHTTPS PortProtocol = "HTTPS"
+	ProtocolGRPC  PortProtocol = "GRPC"
+	ProtocolHTTP2 PortProtocol = "HTTP2"
+	ProtocolMongo PortProtocol = "Mongo"
+	ProtocolTCP   PortProtocol = "TCP"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// GatewayList is a list of Gateway resources
+type GatewayList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []Gateway `json:"items"`
+}

vendor/github.com/knative/pkg/apis/istio/v1alpha3/register.go

@@ -0,0 +1,56 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	"github.com/knative/pkg/apis/istio"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: istio.GroupName, Version: "v1alpha3"}
+
+// Kind takes an unqualified kind and returns back a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&VirtualService{},
+		&Gateway{},
+		&DestinationRule{},
+		&VirtualServiceList{},
+		&GatewayList{},
+		&DestinationRuleList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}

vendor/github.com/knative/pkg/apis/istio/v1alpha3/virtualservice_types.go

@@ -0,0 +1,852 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	"github.com/knative/pkg/apis/istio/common/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// VirtualService
+type VirtualService struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec VirtualServiceSpec `json:"spec"`
+}
+
+// A VirtualService defines a set of traffic routing rules to apply when a host is
+// addressed. Each routing rule defines matching criteria for traffic of a specific
+// protocol. If the traffic is matched, then it is sent to a named destination service
+// (or subset/version of it) defined in the registry.
+//
+// The source of traffic can also be matched in a routing rule. This allows routing
+// to be customized for specific client contexts.
+//
+// The following example routes all HTTP traffic by default to
+// pods of the reviews service with label "version: v1". In addition,
+// HTTP requests containing /wpcatalog/, /consumercatalog/ url prefixes will
+// be rewritten to /newcatalog and sent to pods with label "version: v2". The
+// rules will be applied at the gateway named "bookinfo" as well as at all
+// the sidecars in the mesh (indicated by the reserved gateway name
+// "mesh").
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: reviews-route
+//     spec:
+//       hosts:
+//       - reviews
+//       gateways: # if omitted, defaults to "mesh"
+//       - bookinfo
+//       - mesh
+//       http:
+//       - match:
+//         - uri:
+//             prefix: "/wpcatalog"
+//         - uri:
+//             prefix: "/consumercatalog"
+//         rewrite:
+//           uri: "/newcatalog"
+//         route:
+//         - destination:
+//             host: reviews
+//             subset: v2
+//       - route:
+//         - destination:
+//             host: reviews
+//             subset: v1
+//
+// A subset/version of a route destination is identified with a reference
+// to a named service subset which must be declared in a corresponding
+// DestinationRule.
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: DestinationRule
+//     metadata:
+//       name: reviews-destination
+//     spec:
+//       host: reviews
+//       subsets:
+//       - name: v1
+//         labels:
+//           version: v1
+//       - name: v2
+//         labels:
+//           version: v2
+//
+// A host name can be defined by only one VirtualService. A single
+// VirtualService can be used to describe traffic properties for multiple
+// HTTP and TCP ports.
+type VirtualServiceSpec struct {
+	// REQUIRED. The destination address for traffic captured by this virtual
+	// service. Could be a DNS name with wildcard prefix or a CIDR
+	// prefix. Depending on the platform, short-names can also be used
+	// instead of a FQDN (i.e. has no dots in the name). In such a scenario,
+	// the FQDN of the host would be derived based on the underlying
+	// platform.
+	//
+	// For example on Kubernetes, when hosts contains a short name, Istio will
+	// interpret the short name based on the namespace of the rule. Thus, when a
+	// client namespace applies a rule in the "default" namespace containing a name
+	// "reviews, Istio will setup routes to the "reviews.default.svc.cluster.local"
+	// service. However, if a different name such as "reviews.sales.svc.cluster.local"
+	// is used, it would be treated as a FQDN during virtual host matching.
+	// In Consul, a plain service name would be resolved to the FQDN
+	// "reviews.service.consul".
+	//
+	// Note that the hosts field applies to both HTTP and TCP
+	// services. Service inside the mesh, i.e., those found in the service
+	// registry, must always be referred to using their alphanumeric
+	// names. IP addresses or CIDR prefixes are allowed only for services
+	// defined via the Gateway.
+	Hosts []string `json:"hosts"`
+
+	// The names of gateways and sidecars that should apply these routes. A
+	// single VirtualService is used for sidecars inside the mesh as well
+	// as for one or more gateways. The selection condition imposed by this field
+	// can be overridden using the source field in the match conditions of HTTP/TCP
+	// routes. The reserved word "mesh" is used to imply all the sidecars in
+	// the mesh. When this field is omitted, the default gateway ("mesh")
+	// will be used, which would apply the rule to all sidecars in the
+	// mesh. If a list of gateway names is provided, the rules will apply
+	// only to the gateways. To apply the rules to both gateways and sidecars,
+	// specify "mesh" as one of the gateway names.
+	Gateways []string `json:"gateways,omitempty"`
+
+	// An ordered list of route rules for HTTP traffic.
+	// The first rule matching an incoming request is used.
+	Http []HTTPRoute `json:"http,omitempty"`
+
+	// An ordered list of route rules for TCP traffic.
+	// The first rule matching an incoming request is used.
+	Tcp []TCPRoute `json:"tcp,omitempty"`
+
+	Tls []TLSRoute `json:"tls,omitempty"`
+}
+
+// Describes match conditions and actions for routing HTTP/1.1, HTTP2, and
+// gRPC traffic. See VirtualService for usage examples.
+type HTTPRoute struct {
+	// Match conditions to be satisfied for the rule to be
+	// activated. All conditions inside a single match block have AND
+	// semantics, while the list of match blocks have OR semantics. The rule
+	// is matched if any one of the match blocks succeed.
+	Match []HTTPMatchRequest `json:"match,omitempty"`
+
+	// A http rule can either redirect or forward (default) traffic. The
+	// forwarding target can be one of several versions of a service (see
+	// glossary in beginning of document). Weights associated with the
+	// service version determine the proportion of traffic it receives.
+	Route []DestinationWeight `json:"route,omitempty"`
+
+	// A http rule can either redirect or forward (default) traffic. If
+	// traffic passthrough option is specified in the rule,
+	// route/redirect will be ignored. The redirect primitive can be used to
+	// send a HTTP 302 redirect to a different URI or Authority.
+	Redirect *HTTPRedirect `json:"redirect,omitempty"`
+
+	// Rewrite HTTP URIs and Authority headers. Rewrite cannot be used with
+	// Redirect primitive. Rewrite will be performed before forwarding.
+	Rewrite *HTTPRewrite `json:"rewrite,omitempty"`
+
+	// Indicates that a HTTP/1.1 client connection to this particular route
+	// should be allowed (and expected) to upgrade to a WebSocket connection.
+	// The default is false. Istio's reference sidecar implementation (Envoy)
+	// expects the first request to this route to contain the WebSocket
+	// upgrade headers. Otherwise, the request will be rejected. Note that
+	// Websocket allows secondary protocol negotiation which may then be
+	// subject to further routing rules based on the protocol selected.
+	WebsocketUpgrade bool `json:"websocketUpgrade,omitempty"`
+
+	// Timeout for HTTP requests.
+	Timeout string `json:"timeout,omitempty"`
+
+	// Retry policy for HTTP requests.
+	Retries *HTTPRetry `json:"retries,omitempty"`
+
+	// Fault injection policy to apply on HTTP traffic.
+	Fault *HTTPFaultInjection `json:"fault,omitempty"`
+
+	// Mirror HTTP traffic to a another destination in addition to forwarding
+	// the requests to the intended destination. Mirrored traffic is on a
+	// best effort basis where the sidecar/gateway will not wait for the
+	// mirrored cluster to respond before returning the response from the
+	// original destination.  Statistics will be generated for the mirrored
+	// destination.
+	Mirror *Destination `json:"mirror,omitempty"`
+
+	// Additional HTTP headers to add before forwarding a request to the
+	// destination service.
+	AppendHeaders map[string]string `json:"appendHeaders,omitempty"`
+
+	// Http headers to remove before returning the response to the caller
+	RemoveResponseHeaders map[string]string `json:"removeResponseHeaders,omitempty"`
+
+	// Cross-Origin Resource Sharing policy
+	CorsPolicy *CorsPolicy `json:"corsPolicy,omitempty"`
+}
+
+// HttpMatchRequest specifies a set of criterion to be met in order for the
+// rule to be applied to the HTTP request. For example, the following
+// restricts the rule to match only requests where the URL path
+// starts with /ratings/v2/ and the request contains a "cookie" with value
+// "user=jason".
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: ratings-route
+//     spec:
+//       hosts:
+//       - ratings
+//       http:
+//       - match:
+//         - headers:
+//             cookie:
+//               regex: "^(.*?;)?(user=jason)(;.*)?"
+//             uri:
+//               prefix: "/ratings/v2/"
+//         route:
+//         - destination:
+//             host: ratings
+//
+// HTTPMatchRequest CANNOT be empty.
+type HTTPMatchRequest struct {
+	// URI to match
+	// values are case-sensitive and formatted as follows:
+	//
+	// - `exact: "value"` for exact string match
+	//
+	// - `prefix: "value"` for prefix-based match
+	//
+	// - `regex: "value"` for ECMAscript style regex-based match
+	//
+	Uri *v1alpha1.StringMatch `json:"uri,omitempty"`
+
+	// URI Scheme
+	// values are case-sensitive and formatted as follows:
+	//
+	// - `exact: "value"` for exact string match
+	//
+	// - `prefix: "value"` for prefix-based match
+	//
+	// - `regex: "value"` for ECMAscript style regex-based match
+	//
+	Scheme *v1alpha1.StringMatch `json:"scheme,omitempty"`
+
+	// HTTP Method
+	// values are case-sensitive and formatted as follows:
+	//
+	// - `exact: "value"` for exact string match
+	//
+	// - `prefix: "value"` for prefix-based match
+	//
+	// - `regex: "value"` for ECMAscript style regex-based match
+	//
+	Method *v1alpha1.StringMatch `json:"method,omitempty"`
+
+	// HTTP Authority
+	// values are case-sensitive and formatted as follows:
+	//
+	// - `exact: "value"` for exact string match
+	//
+	// - `prefix: "value"` for prefix-based match
+	//
+	// - `regex: "value"` for ECMAscript style regex-based match
+	//
+	Authority *v1alpha1.StringMatch `json:"authority,omitempty"`
+
+	// The header keys must be lowercase and use hyphen as the separator,
+	// e.g. _x-request-id_.
+	//
+	// Header values are case-sensitive and formatted as follows:
+	//
+	// - `exact: "value"` for exact string match
+	//
+	// - `prefix: "value"` for prefix-based match
+	//
+	// - `regex: "value"` for ECMAscript style regex-based match
+	//
+	// **Note:** The keys `uri`, `scheme`, `method`, and `authority` will be ignored.
+	Headers map[string]v1alpha1.StringMatch `json:"headers,omitempty"`
+
+	// Specifies the ports on the host that is being addressed. Many services
+	// only expose a single port or label ports with the protocols they support,
+	// in these cases it is not required to explicitly select the port.
+	Port uint32 `json:"port,omitempty"`
+
+	// One or more labels that constrain the applicability of a rule to
+	// workloads with the given labels. If the VirtualService has a list of
+	// gateways specified at the top, it should include the reserved gateway
+	// `mesh` in order for this field to be applicable.
+	SourceLabels map[string]string `json:"sourceLabels,omitempty"`
+
+	// Names of gateways where the rule should be applied to. Gateway names
+	// at the top of the VirtualService (if any) are overridden. The gateway match is
+	// independent of sourceLabels.
+	Gateways []string `json:"gateways,omitempty"`
+}
+
+type DestinationWeight struct {
+	// REQUIRED. Destination uniquely identifies the instances of a service
+	// to which the request/connection should be forwarded to.
+	Destination Destination `json:"destination"`
+
+	// REQUIRED. The proportion of traffic to be forwarded to the service
+	// version. (0-100). Sum of weights across destinations SHOULD BE == 100.
+	// If there is only destination in a rule, the weight value is assumed to
+	// be 100.
+	Weight int `json:"weight"`
+}
+
+// Destination indicates the network addressable service to which the
+// request/connection will be sent after processing a routing rule. The
+// destination.name should unambiguously refer to a service in the service
+// registry. It can be a short name or a fully qualified domain name from
+// the service registry, a resolvable DNS name, an IP address or a service
+// name from the service registry and a subset name. The order of inference
+// is as follows:
+//
+// 1. Service registry lookup. The entire name is looked up in the service
+// registry. If the lookup succeeds, the search terminates. The requests
+// will be routed to any instance of the service in the mesh. When the
+// service name consists of a single word, the FQDN will be constructed in
+// a platform specific manner. For example, in Kubernetes, the namespace
+// associated with the routing rule will be used to identify the service as
+// <servicename>.<rulenamespace>. However, if the service name contains
+// multiple words separated by a dot (e.g., reviews.prod), the name in its
+// entirety would be looked up in the service registry.
+//
+// 2. Runtime DNS lookup by the proxy. If step 1 fails, and the name is not
+// an IP address, it will be considered as a DNS name that is not in the
+// service registry (e.g., wikipedia.org). The sidecar/gateway will resolve
+// the DNS and load balance requests appropriately. See Envoy's strict_dns
+// for details.
+//
+// The following example routes all traffic by default to pods of the
+// reviews service with label "version: v1" (i.e., subset v1), and some
+// to subset v2, in a kubernetes environment.
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: reviews-route
+//     spec:
+//       hosts:
+//       - reviews # namespace is same as the client/caller's namespace
+//       http:
+//       - match:
+//         - uri:
+//             prefix: "/wpcatalog"
+//         - uri:
+//             prefix: "/consumercatalog"
+//         rewrite:
+//           uri: "/newcatalog"
+//         route:
+//         - destination:
+//             host: reviews
+//             subset: v2
+//       - route:
+//         - destination:
+//             host: reviews
+//             subset: v1
+//
+// And the associated DestinationRule
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: DestinationRule
+//     metadata:
+//       name: reviews-destination
+//     spec:
+//       host: reviews
+//       subsets:
+//       - name: v1
+//         labels:
+//           version: v1
+//       - name: v2
+//         labels:
+//           version: v2
+//
+// The following VirtualService sets a timeout of 5s for all calls to
+// productpage.prod service. Notice that there are no subsets defined in
+// this rule. Istio will fetch all instances of productpage.prod service
+// from the service registry and populate the sidecar's load balancing
+// pool.
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: my-productpage-rule
+//     spec:
+//       hosts:
+//       - productpage.prod # in kubernetes, this applies only to prod namespace
+//       http:
+//       - timeout: 5s
+//         route:
+//         - destination:
+//             host: productpage.prod
+//
+// The following sets a timeout of 5s for all calls to the external
+// service wikipedia.org, as there is no internal service of that name.
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: my-wiki-rule
+//     spec:
+//       hosts:
+//       - wikipedia.org
+//       http:
+//       - timeout: 5s
+//         route:
+//         - destination:
+//             host: wikipedia.org
+//
+type Destination struct {
+	// REQUIRED. The name of a service from the service registry. Service
+	// names are looked up from the platform's service registry (e.g.,
+	// Kubernetes services, Consul services, etc.) and from the hosts
+	// declared by [ServiceEntry](#ServiceEntry). Traffic forwarded to
+	// destinations that are not found in either of the two, will be dropped.
+	//
+	// *Note for Kubernetes users*: When short names are used (e.g. "reviews"
+	// instead of "reviews.default.svc.cluster.local"), Istio will interpret
+	// the short name based on the namespace of the rule, not the service. A
+	// rule in the "default" namespace containing a host "reviews will be
+	// interpreted as "reviews.default.svc.cluster.local", irrespective of
+	// the actual namespace associated with the reviews service. _To avoid
+	// potential misconfigurations, it is recommended to always use fully
+	// qualified domain names over short names._
+	Host string `json:"host"`
+
+	// The name of a subset within the service. Applicable only to services
+	// within the mesh. The subset must be defined in a corresponding
+	// DestinationRule.
+	Subset string `json:"subset,omitempty"`
+
+	// Specifies the port on the host that is being addressed. If a service
+	// exposes only a single port it is not required to explicitly select the
+	// port.
+	Port PortSelector `json:"port,omitempty"`
+}
+
+// PortSelector specifies the number of a port to be used for
+// matching or selection for final routing.
+type PortSelector struct {
+	// Choose one of the fields below.
+
+	// Valid port number
+	Number uint32 `json:"number,omitempty"`
+
+	// Valid port name
+	Name string `json:"name,omitempty"`
+}
+
+// Describes match conditions and actions for routing TCP traffic. The
+// following routing rule forwards traffic arriving at port 27017 for
+// mongo.prod.svc.cluster.local from 172.17.16.* subnet to another Mongo
+// server on port 5555.
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: VirtualService
+// metadata:
+//   name: bookinfo-Mongo
+// spec:
+//   hosts:
+//   - mongo.prod.svc.cluster.local
+//   tcp:
+//   - match:
+//     - port: 27017
+//       sourceSubnet: "172.17.16.0/24"
+//     route:
+//     - destination:
+//         host: mongo.backup.svc.cluster.local
+//         port:
+//           number: 5555
+// ```
+type TCPRoute struct {
+	// Match conditions to be satisfied for the rule to be
+	// activated. All conditions inside a single match block have AND
+	// semantics, while the list of match blocks have OR semantics. The rule
+	// is matched if any one of the match blocks succeed.
+	Match []L4MatchAttributes `json:"match"`
+
+	// The destinations to which the connection should be forwarded to. Weights
+	// must add to 100%.
+	Route []DestinationWeight `json:"route"`
+}
+
+// Describes match conditions and actions for routing unterminated TLS
+// traffic (TLS/HTTPS) The following routing rule forwards unterminated TLS
+// traffic arriving at port 443 of gateway called mygateway to internal
+// services in the mesh based on the SNI value.
+//
+// ```yaml
+// kind: VirtualService
+// metadata:
+//   name: bookinfo-sni
+// spec:
+//   hosts:
+//   - '*.bookinfo.com'
+//   gateways:
+//   - mygateway
+//   tls:
+//   - match:
+//     - port: 443
+//       sniHosts:
+//       - login.bookinfo.com
+//     route:
+//     - destination:
+//         host: login.prod.svc.cluster.local
+//   - match:
+//     - port: 443
+//       sniHosts:
+//       - reviews.bookinfo.com
+//     route:
+//     - destination:
+//         host: reviews.prod.svc.cluster.local
+// ```
+type TLSRoute struct {
+	// REQUIRED. Match conditions to be satisfied for the rule to be
+	// activated. All conditions inside a single match block have AND
+	// semantics, while the list of match blocks have OR semantics. The rule
+	// is matched if any one of the match blocks succeed.
+	Match []TLSMatchAttributes `json:"match"`
+
+	// The destination to which the connection should be forwarded to.
+	Route []DestinationWeight `json:"route"`
+}
+
+// L4 connection match attributes. Note that L4 connection matching support
+// is incomplete.
+type L4MatchAttributes struct {
+	// IPv4 or IPv6 ip address of destination with optional subnet.  E.g.,
+	// a.b.c.d/xx form or just a.b.c.d.
+	DestinationSubnets []string `json:"destinationSubnets,omitempty"`
+
+	// Specifies the port on the host that is being addressed. Many services
+	// only expose a single port or label ports with the protocols they support,
+	// in these cases it is not required to explicitly select the port.
+	Port int `json:"port,omitempty"`
+
+	// One or more labels that constrain the applicability of a rule to
+	// workloads with the given labels. If the VirtualService has a list of
+	// gateways specified at the top, it should include the reserved gateway
+	// `mesh` in order for this field to be applicable.
+	SourceLabels map[string]string `json:"sourceLabels,omitempty"`
+
+	// Names of gateways where the rule should be applied to. Gateway names
+	// at the top of the VirtualService (if any) are overridden. The gateway match is
+	// independent of sourceLabels.
+	Gateways []string `json:"gateways,omitempty"`
+}
+
+// TLS connection match attributes.
+type TLSMatchAttributes struct {
+	// REQUIRED. SNI (server name indicator) to match on. Wildcard prefixes
+	// can be used in the SNI value, e.g., *.com will match foo.example.com
+	// as well as example.com. An SNI value must be a subset (i.e., fall
+	// within the domain) of the corresponding virtual service's hosts
+	SniHosts []string `json:"sniHosts"`
+
+	// IPv4 or IPv6 ip addresses of destination with optional subnet.  E.g.,
+	// a.b.c.d/xx form or just a.b.c.d.
+	DestinationSubnets []string `json:"destinationSubnets,omitempty"`
+
+	// Specifies the port on the host that is being addressed. Many services
+	// only expose a single port or label ports with the protocols they support,
+	// in these cases it is not required to explicitly select the port.
+	Port int `json:"port,omitempty"`
+
+	// One or more labels that constrain the applicability of a rule to
+	// workloads with the given labels. If the VirtualService has a list of
+	// gateways specified at the top, it should include the reserved gateway
+	// `mesh` in order for this field to be applicable.
+	SourceLabels map[string]string `json:"sourceLabels,omitempty"`
+
+	// Names of gateways where the rule should be applied to. Gateway names
+	// at the top of the VirtualService (if any) are overridden. The gateway match is
+	// independent of sourceLabels.
+	Gateways []string `json:"gateways,omitempty"`
+}
+
+// HTTPRedirect can be used to send a 302 redirect response to the caller,
+// where the Authority/Host and the URI in the response can be swapped with
+// the specified values. For example, the following rule redirects
+// requests for /v1/getProductRatings API on the ratings service to
+// /v1/bookRatings provided by the bookratings service.
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: ratings-route
+//     spec:
+//       hosts:
+//       - ratings
+//       http:
+//       - match:
+//         - uri:
+//             exact: /v1/getProductRatings
+//       redirect:
+//         uri: /v1/bookRatings
+//         authority: bookratings.default.svc.cluster.local
+//       ...
+//
+type HTTPRedirect struct {
+	// On a redirect, overwrite the Path portion of the URL with this
+	// value. Note that the entire path will be replaced, irrespective of the
+	// request URI being matched as an exact path or prefix.
+	Uri string `json:"uri,omitempty"`
+
+	// On a redirect, overwrite the Authority/Host portion of the URL with
+	// this value.
+	Authority string `json:"authority,omitempty"`
+}
+
+// HTTPRewrite can be used to rewrite specific parts of a HTTP request
+// before forwarding the request to the destination. Rewrite primitive can
+// be used only with the DestinationWeights. The following example
+// demonstrates how to rewrite the URL prefix for api call (/ratings) to
+// ratings service before making the actual API call.
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: ratings-route
+//     spec:
+//       hosts:
+//       - ratings
+//       http:
+//       - match:
+//         - uri:
+//             prefix: /ratings
+//         rewrite:
+//           uri: /v1/bookRatings
+//         route:
+//         - destination:
+//             host: ratings
+//             subset: v1
+//
+type HTTPRewrite struct {
+	// rewrite the path (or the prefix) portion of the URI with this
+	// value. If the original URI was matched based on prefix, the value
+	// provided in this field will replace the corresponding matched prefix.
+	Uri string `json:"uri,omitempty"`
+
+	// rewrite the Authority/Host header with this value.
+	Authority string `json:"authority,omitempty"`
+}
+
+// Describes the retry policy to use when a HTTP request fails. For
+// example, the following rule sets the maximum number of retries to 3 when
+// calling ratings:v1 service, with a 2s timeout per retry attempt.
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: ratings-route
+//     spec:
+//       hosts:
+//       - ratings
+//       http:
+//       - route:
+//         - destination:
+//             host: ratings
+//             subset: v1
+//         retries:
+//           attempts: 3
+//           perTryTimeout: 2s
+//
+type HTTPRetry struct {
+	// REQUIRED. Number of retries for a given request. The interval
+	// between retries will be determined automatically (25ms+). Actual
+	// number of retries attempted depends on the httpReqTimeout.
+	Attempts int `json:"attempts"`
+
+	// Timeout per retry attempt for a given request. format: 1h/1m/1s/1ms. MUST BE >=1ms.
+	PerTryTimeout string `json:"perTryTimeout"`
+}
+
+// Describes the Cross-Origin Resource Sharing (CORS) policy, for a given
+// service. Refer to
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
+// for further details about cross origin resource sharing. For example,
+// the following rule restricts cross origin requests to those originating
+// from example.com domain using HTTP POST/GET, and sets the
+// Access-Control-Allow-Credentials header to false. In addition, it only
+// exposes X-Foo-bar header and sets an expiry period of 1 day.
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: ratings-route
+//     spec:
+//       hosts:
+//       - ratings
+//       http:
+//       - route:
+//         - destination:
+//             host: ratings
+//             subset: v1
+//         corsPolicy:
+//           allowOrigin:
+//           - example.com
+//           allowMethods:
+//           - POST
+//           - GET
+//           allowCredentials: false
+//           allowHeaders:
+//           - X-Foo-Bar
+//           maxAge: "1d"
+//
+type CorsPolicy struct {
+	// The list of origins that are allowed to perform CORS requests. The
+	// content will be serialized into the Access-Control-Allow-Origin
+	// header. Wildcard * will allow all origins.
+	AllowOrigin []string `json:"allowOrigin,omitempty"`
+
+	// List of HTTP methods allowed to access the resource. The content will
+	// be serialized into the Access-Control-Allow-Methods header.
+	AllowMethods []string `json:"allowMethods,omitempty"`
+
+	// List of HTTP headers that can be used when requesting the
+	// resource. Serialized to Access-Control-Allow-Methods header.
+	AllowHeaders []string `json:"allowHeaders,omitempty"`
+
+	// A white list of HTTP headers that the browsers are allowed to
+	// access. Serialized into Access-Control-Expose-Headers header.
+	ExposeHeaders []string `json:"exposeHeaders,omitempty"`
+
+	// Specifies how long the the results of a preflight request can be
+	// cached. Translates to the Access-Control-Max-Age header.
+	MaxAge string `json:"maxAge,omitempty"`
+
+	// Indicates whether the caller is allowed to send the actual request
+	// (not the preflight) using credentials. Translates to
+	// Access-Control-Allow-Credentials header.
+	AllowCredentials bool `json:"allowCredentials,omitempty"`
+}
+
+// HTTPFaultInjection can be used to specify one or more faults to inject
+// while forwarding http requests to the destination specified in a route.
+// Fault specification is part of a VirtualService rule. Faults include
+// aborting the Http request from downstream service, and/or delaying
+// proxying of requests. A fault rule MUST HAVE delay or abort or both.
+//
+// *Note:* Delay and abort faults are independent of one another, even if
+// both are specified simultaneously.
+type HTTPFaultInjection struct {
+	// Delay requests before forwarding, emulating various failures such as
+	// network issues, overloaded upstream service, etc.
+	Delay *InjectDelay `json:"delay,omitempty"`
+
+	// Abort Http request attempts and return error codes back to downstream
+	// service, giving the impression that the upstream service is faulty.
+	Abort *InjectAbort `json:"abort,omitempty"`
+}
+
+// Delay specification is used to inject latency into the request
+// forwarding path. The following example will introduce a 5 second delay
+// in 10% of the requests to the "v1" version of the "reviews"
+// service from all pods with label env: prod
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: reviews-route
+//     spec:
+//       hosts:
+//       - reviews
+//       http:
+//       - match:
+//         - sourceLabels:
+//             env: prod
+//         route:
+//         - destination:
+//             host: reviews
+//             subset: v1
+//         fault:
+//           delay:
+//             percent: 10
+//             fixedDelay: 5s
+//
+// The _fixedDelay_ field is used to indicate the amount of delay in
+// seconds. An optional _percent_ field, a value between 0 and 100, can
+// be used to only delay a certain percentage of requests. If left
+// unspecified, all request will be delayed.
+type InjectDelay struct {
+	// Percentage of requests on which the delay will be injected (0-100).
+	Percent int `json:"percent,omitempty"`
+
+	// REQUIRED. Add a fixed delay before forwarding the request. Format:
+	// 1h/1m/1s/1ms. MUST be >=1ms.
+	FixedDelay string `json:"fixedDelay"`
+
+	// (-- Add a delay (based on an exponential function) before forwarding
+	// the request. mean delay needed to derive the exponential delay
+	// values --)
+	ExponentialDelay string `json:"exponentialDelay,omitempty"`
+}
+
+// Abort specification is used to prematurely abort a request with a
+// pre-specified error code. The following example will return an HTTP
+// 400 error code for 10% of the requests to the "ratings" service "v1".
+//
+//     apiVersion: networking.istio.io/v1alpha3
+//     kind: VirtualService
+//     metadata:
+//       name: ratings-route
+//     spec:
+//       hosts:
+//       - ratings
+//       http:
+//       - route:
+//         - destination:
+//             host: ratings
+//             subset: v1
+//         fault:
+//           abort:
+//             percent: 10
+//             httpStatus: 400
+//
+// The _httpStatus_ field is used to indicate the HTTP status code to
+// return to the caller. The optional _percent_ field, a value between 0
+// and 100, is used to only abort a certain percentage of requests. If
+// not specified, all requests are aborted.
+type InjectAbort struct {
+	// Percentage of requests to be aborted with the error code provided (0-100).
+	Perecent int `json:"percent,omitempty"`
+
+	// REQUIRED. HTTP status code to use to abort the Http request.
+	HttpStatus int `json:"httpStatus"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// VirtualServiceList is a list of VirtualService resources
+type VirtualServiceList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []VirtualService `json:"items"`
+}

vendor/github.com/knative/pkg/client/clientset/versioned/clientset.go

@@ -0,0 +1,120 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package versioned
+
+import (
+	authenticationv1alpha1 "github.com/knative/pkg/client/clientset/versioned/typed/authentication/v1alpha1"
+	networkingv1alpha3 "github.com/knative/pkg/client/clientset/versioned/typed/istio/v1alpha3"
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+)
+
+type Interface interface {
+	Discovery() discovery.DiscoveryInterface
+	AuthenticationV1alpha1() authenticationv1alpha1.AuthenticationV1alpha1Interface
+	// Deprecated: please explicitly pick a version if possible.
+	Authentication() authenticationv1alpha1.AuthenticationV1alpha1Interface
+	NetworkingV1alpha3() networkingv1alpha3.NetworkingV1alpha3Interface
+	// Deprecated: please explicitly pick a version if possible.
+	Networking() networkingv1alpha3.NetworkingV1alpha3Interface
+}
+
+// Clientset contains the clients for groups. Each group has exactly one
+// version included in a Clientset.
+type Clientset struct {
+	*discovery.DiscoveryClient
+	authenticationV1alpha1 *authenticationv1alpha1.AuthenticationV1alpha1Client
+	networkingV1alpha3     *networkingv1alpha3.NetworkingV1alpha3Client
+}
+
+// AuthenticationV1alpha1 retrieves the AuthenticationV1alpha1Client
+func (c *Clientset) AuthenticationV1alpha1() authenticationv1alpha1.AuthenticationV1alpha1Interface {
+	return c.authenticationV1alpha1
+}
+
+// Deprecated: Authentication retrieves the default version of AuthenticationClient.
+// Please explicitly pick a version.
+func (c *Clientset) Authentication() authenticationv1alpha1.AuthenticationV1alpha1Interface {
+	return c.authenticationV1alpha1
+}
+
+// NetworkingV1alpha3 retrieves the NetworkingV1alpha3Client
+func (c *Clientset) NetworkingV1alpha3() networkingv1alpha3.NetworkingV1alpha3Interface {
+	return c.networkingV1alpha3
+}
+
+// Deprecated: Networking retrieves the default version of NetworkingClient.
+// Please explicitly pick a version.
+func (c *Clientset) Networking() networkingv1alpha3.NetworkingV1alpha3Interface {
+	return c.networkingV1alpha3
+}
+
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// NewForConfig creates a new Clientset for the given config.
+func NewForConfig(c *rest.Config) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+	var cs Clientset
+	var err error
+	cs.authenticationV1alpha1, err = authenticationv1alpha1.NewForConfig(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+	cs.networkingV1alpha3, err = networkingv1alpha3.NewForConfig(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *Clientset {
+	var cs Clientset
+	cs.authenticationV1alpha1 = authenticationv1alpha1.NewForConfigOrDie(c)
+	cs.networkingV1alpha3 = networkingv1alpha3.NewForConfigOrDie(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c)
+	return &cs
+}
+
+// New creates a new Clientset for the given RESTClient.
+func New(c rest.Interface) *Clientset {
+	var cs Clientset
+	cs.authenticationV1alpha1 = authenticationv1alpha1.New(c)
+	cs.networkingV1alpha3 = networkingv1alpha3.New(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
+	return &cs
+}

vendor/github.com/knative/pkg/client/clientset/versioned/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated clientset.
+package versioned

vendor/github.com/knative/pkg/client/clientset/versioned/scheme/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme

vendor/github.com/knative/pkg/client/clientset/versioned/scheme/register.go

@@ -0,0 +1,58 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	authenticationv1alpha1 "github.com/knative/pkg/apis/istio/authentication/v1alpha1"
+	networkingv1alpha3 "github.com/knative/pkg/apis/istio/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	authenticationv1alpha1.AddToScheme,
+	networkingv1alpha3.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//   import (
+//     "k8s.io/client-go/kubernetes"
+//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//   )
+//
+//   kclientset, _ := kubernetes.NewForConfig(c)
+//   _ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(Scheme))
+}

vendor/github.com/knative/pkg/client/clientset/versioned/typed/authentication/v1alpha1/authentication_client.go

@@ -0,0 +1,90 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1alpha1 "github.com/knative/pkg/apis/istio/authentication/v1alpha1"
+	"github.com/knative/pkg/client/clientset/versioned/scheme"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	rest "k8s.io/client-go/rest"
+)
+
+type AuthenticationV1alpha1Interface interface {
+	RESTClient() rest.Interface
+	PoliciesGetter
+}
+
+// AuthenticationV1alpha1Client is used to interact with features provided by the authentication.istio.io group.
+type AuthenticationV1alpha1Client struct {
+	restClient rest.Interface
+}
+
+func (c *AuthenticationV1alpha1Client) Policies(namespace string) PolicyInterface {
+	return newPolicies(c, namespace)
+}
+
+// NewForConfig creates a new AuthenticationV1alpha1Client for the given config.
+func NewForConfig(c *rest.Config) (*AuthenticationV1alpha1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return &AuthenticationV1alpha1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new AuthenticationV1alpha1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *AuthenticationV1alpha1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new AuthenticationV1alpha1Client for the given RESTClient.
+func New(c rest.Interface) *AuthenticationV1alpha1Client {
+	return &AuthenticationV1alpha1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) error {
+	gv := v1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = serializer.DirectCodecFactory{CodecFactory: scheme.Codecs}
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	return nil
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AuthenticationV1alpha1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}

vendor/github.com/knative/pkg/client/clientset/versioned/typed/authentication/v1alpha1/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1

vendor/github.com/knative/pkg/client/clientset/versioned/typed/authentication/v1alpha1/generated_expansion.go

@@ -0,0 +1,21 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type PolicyExpansion interface{}

vendor/github.com/knative/pkg/client/clientset/versioned/typed/authentication/v1alpha1/policy.go

@@ -0,0 +1,157 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1alpha1 "github.com/knative/pkg/apis/istio/authentication/v1alpha1"
+	scheme "github.com/knative/pkg/client/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// PoliciesGetter has a method to return a PolicyInterface.
+// A group's client should implement this interface.
+type PoliciesGetter interface {
+	Policies(namespace string) PolicyInterface
+}
+
+// PolicyInterface has methods to work with Policy resources.
+type PolicyInterface interface {
+	Create(*v1alpha1.Policy) (*v1alpha1.Policy, error)
+	Update(*v1alpha1.Policy) (*v1alpha1.Policy, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha1.Policy, error)
+	List(opts v1.ListOptions) (*v1alpha1.PolicyList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.Policy, err error)
+	PolicyExpansion
+}
+
+// policies implements PolicyInterface
+type policies struct {
+	client rest.Interface
+	ns     string
+}
+
+// newPolicies returns a Policies
+func newPolicies(c *AuthenticationV1alpha1Client, namespace string) *policies {
+	return &policies{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the policy, and returns the corresponding policy object, and an error if there is any.
+func (c *policies) Get(name string, options v1.GetOptions) (result *v1alpha1.Policy, err error) {
+	result = &v1alpha1.Policy{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("policies").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Policies that match those selectors.
+func (c *policies) List(opts v1.ListOptions) (result *v1alpha1.PolicyList, err error) {
+	result = &v1alpha1.PolicyList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("policies").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested policies.
+func (c *policies) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("policies").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Create takes the representation of a policy and creates it.  Returns the server's representation of the policy, and an error, if there is any.
+func (c *policies) Create(policy *v1alpha1.Policy) (result *v1alpha1.Policy, err error) {
+	result = &v1alpha1.Policy{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("policies").
+		Body(policy).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a policy and updates it. Returns the server's representation of the policy, and an error, if there is any.
+func (c *policies) Update(policy *v1alpha1.Policy) (result *v1alpha1.Policy, err error) {
+	result = &v1alpha1.Policy{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("policies").
+		Name(policy.Name).
+		Body(policy).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the policy and deletes it. Returns an error if one occurs.
+func (c *policies) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("policies").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *policies) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("policies").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched policy.
+func (c *policies) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha1.Policy, err error) {
+	result = &v1alpha1.Policy{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("policies").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

vendor/github.com/knative/pkg/client/clientset/versioned/typed/istio/v1alpha3/destinationrule.go

@@ -0,0 +1,157 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/knative/pkg/apis/istio/v1alpha3"
+	scheme "github.com/knative/pkg/client/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// DestinationRulesGetter has a method to return a DestinationRuleInterface.
+// A group's client should implement this interface.
+type DestinationRulesGetter interface {
+	DestinationRules(namespace string) DestinationRuleInterface
+}
+
+// DestinationRuleInterface has methods to work with DestinationRule resources.
+type DestinationRuleInterface interface {
+	Create(*v1alpha3.DestinationRule) (*v1alpha3.DestinationRule, error)
+	Update(*v1alpha3.DestinationRule) (*v1alpha3.DestinationRule, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha3.DestinationRule, error)
+	List(opts v1.ListOptions) (*v1alpha3.DestinationRuleList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.DestinationRule, err error)
+	DestinationRuleExpansion
+}
+
+// destinationRules implements DestinationRuleInterface
+type destinationRules struct {
+	client rest.Interface
+	ns     string
+}
+
+// newDestinationRules returns a DestinationRules
+func newDestinationRules(c *NetworkingV1alpha3Client, namespace string) *destinationRules {
+	return &destinationRules{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the destinationRule, and returns the corresponding destinationRule object, and an error if there is any.
+func (c *destinationRules) Get(name string, options v1.GetOptions) (result *v1alpha3.DestinationRule, err error) {
+	result = &v1alpha3.DestinationRule{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("destinationrules").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of DestinationRules that match those selectors.
+func (c *destinationRules) List(opts v1.ListOptions) (result *v1alpha3.DestinationRuleList, err error) {
+	result = &v1alpha3.DestinationRuleList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("destinationrules").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested destinationRules.
+func (c *destinationRules) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("destinationrules").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Create takes the representation of a destinationRule and creates it.  Returns the server's representation of the destinationRule, and an error, if there is any.
+func (c *destinationRules) Create(destinationRule *v1alpha3.DestinationRule) (result *v1alpha3.DestinationRule, err error) {
+	result = &v1alpha3.DestinationRule{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("destinationrules").
+		Body(destinationRule).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a destinationRule and updates it. Returns the server's representation of the destinationRule, and an error, if there is any.
+func (c *destinationRules) Update(destinationRule *v1alpha3.DestinationRule) (result *v1alpha3.DestinationRule, err error) {
+	result = &v1alpha3.DestinationRule{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("destinationrules").
+		Name(destinationRule.Name).
+		Body(destinationRule).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the destinationRule and deletes it. Returns an error if one occurs.
+func (c *destinationRules) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("destinationrules").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *destinationRules) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("destinationrules").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched destinationRule.
+func (c *destinationRules) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.DestinationRule, err error) {
+	result = &v1alpha3.DestinationRule{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("destinationrules").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

vendor/github.com/knative/pkg/client/clientset/versioned/typed/istio/v1alpha3/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha3

vendor/github.com/knative/pkg/client/clientset/versioned/typed/istio/v1alpha3/gateway.go

@@ -0,0 +1,157 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/knative/pkg/apis/istio/v1alpha3"
+	scheme "github.com/knative/pkg/client/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// GatewaysGetter has a method to return a GatewayInterface.
+// A group's client should implement this interface.
+type GatewaysGetter interface {
+	Gateways(namespace string) GatewayInterface
+}
+
+// GatewayInterface has methods to work with Gateway resources.
+type GatewayInterface interface {
+	Create(*v1alpha3.Gateway) (*v1alpha3.Gateway, error)
+	Update(*v1alpha3.Gateway) (*v1alpha3.Gateway, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha3.Gateway, error)
+	List(opts v1.ListOptions) (*v1alpha3.GatewayList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Gateway, err error)
+	GatewayExpansion
+}
+
+// gateways implements GatewayInterface
+type gateways struct {
+	client rest.Interface
+	ns     string
+}
+
+// newGateways returns a Gateways
+func newGateways(c *NetworkingV1alpha3Client, namespace string) *gateways {
+	return &gateways{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the gateway, and returns the corresponding gateway object, and an error if there is any.
+func (c *gateways) Get(name string, options v1.GetOptions) (result *v1alpha3.Gateway, err error) {
+	result = &v1alpha3.Gateway{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("gateways").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Gateways that match those selectors.
+func (c *gateways) List(opts v1.ListOptions) (result *v1alpha3.GatewayList, err error) {
+	result = &v1alpha3.GatewayList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("gateways").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested gateways.
+func (c *gateways) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("gateways").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Create takes the representation of a gateway and creates it.  Returns the server's representation of the gateway, and an error, if there is any.
+func (c *gateways) Create(gateway *v1alpha3.Gateway) (result *v1alpha3.Gateway, err error) {
+	result = &v1alpha3.Gateway{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("gateways").
+		Body(gateway).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a gateway and updates it. Returns the server's representation of the gateway, and an error, if there is any.
+func (c *gateways) Update(gateway *v1alpha3.Gateway) (result *v1alpha3.Gateway, err error) {
+	result = &v1alpha3.Gateway{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("gateways").
+		Name(gateway.Name).
+		Body(gateway).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the gateway and deletes it. Returns an error if one occurs.
+func (c *gateways) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("gateways").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *gateways) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("gateways").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched gateway.
+func (c *gateways) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.Gateway, err error) {
+	result = &v1alpha3.Gateway{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("gateways").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

vendor/github.com/knative/pkg/client/clientset/versioned/typed/istio/v1alpha3/generated_expansion.go

@@ -0,0 +1,25 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+type DestinationRuleExpansion interface{}
+
+type GatewayExpansion interface{}
+
+type VirtualServiceExpansion interface{}

vendor/github.com/knative/pkg/client/clientset/versioned/typed/istio/v1alpha3/istio_client.go

@@ -0,0 +1,100 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/knative/pkg/apis/istio/v1alpha3"
+	"github.com/knative/pkg/client/clientset/versioned/scheme"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	rest "k8s.io/client-go/rest"
+)
+
+type NetworkingV1alpha3Interface interface {
+	RESTClient() rest.Interface
+	DestinationRulesGetter
+	GatewaysGetter
+	VirtualServicesGetter
+}
+
+// NetworkingV1alpha3Client is used to interact with features provided by the networking.istio.io group.
+type NetworkingV1alpha3Client struct {
+	restClient rest.Interface
+}
+
+func (c *NetworkingV1alpha3Client) DestinationRules(namespace string) DestinationRuleInterface {
+	return newDestinationRules(c, namespace)
+}
+
+func (c *NetworkingV1alpha3Client) Gateways(namespace string) GatewayInterface {
+	return newGateways(c, namespace)
+}
+
+func (c *NetworkingV1alpha3Client) VirtualServices(namespace string) VirtualServiceInterface {
+	return newVirtualServices(c, namespace)
+}
+
+// NewForConfig creates a new NetworkingV1alpha3Client for the given config.
+func NewForConfig(c *rest.Config) (*NetworkingV1alpha3Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return &NetworkingV1alpha3Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new NetworkingV1alpha3Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *NetworkingV1alpha3Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new NetworkingV1alpha3Client for the given RESTClient.
+func New(c rest.Interface) *NetworkingV1alpha3Client {
+	return &NetworkingV1alpha3Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) error {
+	gv := v1alpha3.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = serializer.DirectCodecFactory{CodecFactory: scheme.Codecs}
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	return nil
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *NetworkingV1alpha3Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}

vendor/github.com/knative/pkg/client/clientset/versioned/typed/istio/v1alpha3/virtualservice.go

@@ -0,0 +1,157 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1alpha3 "github.com/knative/pkg/apis/istio/v1alpha3"
+	scheme "github.com/knative/pkg/client/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// VirtualServicesGetter has a method to return a VirtualServiceInterface.
+// A group's client should implement this interface.
+type VirtualServicesGetter interface {
+	VirtualServices(namespace string) VirtualServiceInterface
+}
+
+// VirtualServiceInterface has methods to work with VirtualService resources.
+type VirtualServiceInterface interface {
+	Create(*v1alpha3.VirtualService) (*v1alpha3.VirtualService, error)
+	Update(*v1alpha3.VirtualService) (*v1alpha3.VirtualService, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha3.VirtualService, error)
+	List(opts v1.ListOptions) (*v1alpha3.VirtualServiceList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.VirtualService, err error)
+	VirtualServiceExpansion
+}
+
+// virtualServices implements VirtualServiceInterface
+type virtualServices struct {
+	client rest.Interface
+	ns     string
+}
+
+// newVirtualServices returns a VirtualServices
+func newVirtualServices(c *NetworkingV1alpha3Client, namespace string) *virtualServices {
+	return &virtualServices{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the virtualService, and returns the corresponding virtualService object, and an error if there is any.
+func (c *virtualServices) Get(name string, options v1.GetOptions) (result *v1alpha3.VirtualService, err error) {
+	result = &v1alpha3.VirtualService{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("virtualservices").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of VirtualServices that match those selectors.
+func (c *virtualServices) List(opts v1.ListOptions) (result *v1alpha3.VirtualServiceList, err error) {
+	result = &v1alpha3.VirtualServiceList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("virtualservices").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested virtualServices.
+func (c *virtualServices) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("virtualservices").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Watch()
+}
+
+// Create takes the representation of a virtualService and creates it.  Returns the server's representation of the virtualService, and an error, if there is any.
+func (c *virtualServices) Create(virtualService *v1alpha3.VirtualService) (result *v1alpha3.VirtualService, err error) {
+	result = &v1alpha3.VirtualService{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("virtualservices").
+		Body(virtualService).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a virtualService and updates it. Returns the server's representation of the virtualService, and an error, if there is any.
+func (c *virtualServices) Update(virtualService *v1alpha3.VirtualService) (result *v1alpha3.VirtualService, err error) {
+	result = &v1alpha3.VirtualService{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("virtualservices").
+		Name(virtualService.Name).
+		Body(virtualService).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the virtualService and deletes it. Returns an error if one occurs.
+func (c *virtualServices) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("virtualservices").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *virtualServices) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("virtualservices").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched virtualService.
+func (c *virtualServices) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha3.VirtualService, err error) {
+	result = &v1alpha3.VirtualService{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("virtualservices").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

vendor/github.com/knative/pkg/client/informers/externalversions/authentication/interface.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package authentication
+
+import (
+	v1alpha1 "github.com/knative/pkg/client/informers/externalversions/authentication/v1alpha1"
+	internalinterfaces "github.com/knative/pkg/client/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() v1alpha1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1alpha1 returns a new v1alpha1.Interface.
+func (g *group) V1alpha1() v1alpha1.Interface {
+	return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions)
+}

vendor/github.com/knative/pkg/client/informers/externalversions/authentication/v1alpha1/interface.go

@@ -0,0 +1,45 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	internalinterfaces "github.com/knative/pkg/client/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// Policies returns a PolicyInformer.
+	Policies() PolicyInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// Policies returns a PolicyInformer.
+func (v *version) Policies() PolicyInformer {
+	return &policyInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}

vendor/github.com/knative/pkg/client/informers/externalversions/authentication/v1alpha1/policy.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	time "time"
+
+	authenticationv1alpha1 "github.com/knative/pkg/apis/istio/authentication/v1alpha1"
+	versioned "github.com/knative/pkg/client/clientset/versioned"
+	internalinterfaces "github.com/knative/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha1 "github.com/knative/pkg/client/listers/authentication/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// PolicyInformer provides access to a shared informer and lister for
+// Policies.
+type PolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha1.PolicyLister
+}
+
+type policyInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewPolicyInformer constructs a new informer for Policy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewPolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredPolicyInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredPolicyInformer constructs a new informer for Policy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredPolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AuthenticationV1alpha1().Policies(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AuthenticationV1alpha1().Policies(namespace).Watch(options)
+			},
+		},
+		&authenticationv1alpha1.Policy{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *policyInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredPolicyInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *policyInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&authenticationv1alpha1.Policy{}, f.defaultInformer)
+}
+
+func (f *policyInformer) Lister() v1alpha1.PolicyLister {
+	return v1alpha1.NewPolicyLister(f.Informer().GetIndexer())
+}

vendor/github.com/knative/pkg/client/informers/externalversions/factory.go

@@ -0,0 +1,186 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	reflect "reflect"
+	sync "sync"
+	time "time"
+
+	versioned "github.com/knative/pkg/client/clientset/versioned"
+	authentication "github.com/knative/pkg/client/informers/externalversions/authentication"
+	internalinterfaces "github.com/knative/pkg/client/informers/externalversions/internalinterfaces"
+	istio "github.com/knative/pkg/client/informers/externalversions/istio"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// SharedInformerOption defines the functional option type for SharedInformerFactory.
+type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
+
+type sharedInformerFactory struct {
+	client           versioned.Interface
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	lock             sync.Mutex
+	defaultResync    time.Duration
+	customResync     map[reflect.Type]time.Duration
+
+	informers map[reflect.Type]cache.SharedIndexInformer
+	// startedInformers is used for tracking which informers have been started.
+	// This allows Start() to be called multiple times safely.
+	startedInformers map[reflect.Type]bool
+}
+
+// WithCustomResyncConfig sets a custom resync period for the specified informer types.
+func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		for k, v := range resyncConfig {
+			factory.customResync[reflect.TypeOf(k)] = v
+		}
+		return factory
+	}
+}
+
+// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
+func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.tweakListOptions = tweakListOptions
+		return factory
+	}
+}
+
+// WithNamespace limits the SharedInformerFactory to the specified namespace.
+func WithNamespace(namespace string) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.namespace = namespace
+		return factory
+	}
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync)
+}
+
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client versioned.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
+}
+
+// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
+func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
+	factory := &sharedInformerFactory{
+		client:           client,
+		namespace:        v1.NamespaceAll,
+		defaultResync:    defaultResync,
+		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
+		startedInformers: make(map[reflect.Type]bool),
+		customResync:     make(map[reflect.Type]time.Duration),
+	}
+
+	// Apply all options
+	for _, opt := range options {
+		factory = opt(factory)
+	}
+
+	return factory
+}
+
+// Start initializes all requested informers.
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			go informer.Run(stopCh)
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+// WaitForCacheSync waits for all started informers' cache were synced.
+func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	informers := func() map[reflect.Type]cache.SharedIndexInformer {
+		f.lock.Lock()
+		defer f.lock.Unlock()
+
+		informers := map[reflect.Type]cache.SharedIndexInformer{}
+		for informerType, informer := range f.informers {
+			if f.startedInformers[informerType] {
+				informers[informerType] = informer
+			}
+		}
+		return informers
+	}()
+
+	res := map[reflect.Type]bool{}
+	for informType, informer := range informers {
+		res[informType] = cache.WaitForCacheSync(stopCh, informer.HasSynced)
+	}
+	return res
+}
+
+// InternalInformerFor returns the SharedIndexInformer for obj using an internal
+// client.
+func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(obj)
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+
+	resyncPeriod, exists := f.customResync[informerType]
+	if !exists {
+		resyncPeriod = f.defaultResync
+	}
+
+	informer = newFunc(f.client, resyncPeriod)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// SharedInformerFactory provides shared informers for resources in all known
+// API group versions.
+type SharedInformerFactory interface {
+	internalinterfaces.SharedInformerFactory
+	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
+
+	Authentication() authentication.Interface
+	Networking() istio.Interface
+}
+
+func (f *sharedInformerFactory) Authentication() authentication.Interface {
+	return authentication.New(f, f.namespace, f.tweakListOptions)
+}
+
+func (f *sharedInformerFactory) Networking() istio.Interface {
+	return istio.New(f, f.namespace, f.tweakListOptions)
+}

vendor/github.com/knative/pkg/client/informers/externalversions/generic.go

@@ -0,0 +1,71 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	"fmt"
+
+	v1alpha1 "github.com/knative/pkg/apis/istio/authentication/v1alpha1"
+	v1alpha3 "github.com/knative/pkg/apis/istio/v1alpha3"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// GenericInformer is type of SharedIndexInformer which will locate and delegate to other
+// sharedInformers based on type
+type GenericInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.GenericLister
+}
+
+type genericInformer struct {
+	informer cache.SharedIndexInformer
+	resource schema.GroupResource
+}
+
+// Informer returns the SharedIndexInformer.
+func (f *genericInformer) Informer() cache.SharedIndexInformer {
+	return f.informer
+}
+
+// Lister returns the GenericLister.
+func (f *genericInformer) Lister() cache.GenericLister {
+	return cache.NewGenericLister(f.Informer().GetIndexer(), f.resource)
+}
+
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
+	switch resource {
+	// Group=authentication.istio.io, Version=v1alpha1
+	case v1alpha1.SchemeGroupVersion.WithResource("policies"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Authentication().V1alpha1().Policies().Informer()}, nil
+
+		// Group=networking.istio.io, Version=v1alpha3
+	case v1alpha3.SchemeGroupVersion.WithResource("destinationrules"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Networking().V1alpha3().DestinationRules().Informer()}, nil
+	case v1alpha3.SchemeGroupVersion.WithResource("gateways"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Networking().V1alpha3().Gateways().Informer()}, nil
+	case v1alpha3.SchemeGroupVersion.WithResource("virtualservices"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Networking().V1alpha3().VirtualServices().Informer()}, nil
+
+	}
+
+	return nil, fmt.Errorf("no informer found for %v", resource)
+}

vendor/github.com/knative/pkg/client/informers/externalversions/internalinterfaces/factory_interfaces.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package internalinterfaces
+
+import (
+	time "time"
+
+	versioned "github.com/knative/pkg/client/clientset/versioned"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+type NewInformerFunc func(versioned.Interface, time.Duration) cache.SharedIndexInformer
+
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
+type SharedInformerFactory interface {
+	Start(stopCh <-chan struct{})
+	InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer
+}
+
+type TweakListOptionsFunc func(*v1.ListOptions)

vendor/github.com/knative/pkg/client/informers/externalversions/istio/interface.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package networking
+
+import (
+	internalinterfaces "github.com/knative/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha3 "github.com/knative/pkg/client/informers/externalversions/istio/v1alpha3"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1alpha3 provides access to shared informers for resources in V1alpha3.
+	V1alpha3() v1alpha3.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1alpha3 returns a new v1alpha3.Interface.
+func (g *group) V1alpha3() v1alpha3.Interface {
+	return v1alpha3.New(g.factory, g.namespace, g.tweakListOptions)
+}

vendor/github.com/knative/pkg/client/informers/externalversions/istio/v1alpha3/destinationrule.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	time "time"
+
+	istiov1alpha3 "github.com/knative/pkg/apis/istio/v1alpha3"
+	versioned "github.com/knative/pkg/client/clientset/versioned"
+	internalinterfaces "github.com/knative/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha3 "github.com/knative/pkg/client/listers/istio/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// DestinationRuleInformer provides access to a shared informer and lister for
+// DestinationRules.
+type DestinationRuleInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha3.DestinationRuleLister
+}
+
+type destinationRuleInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewDestinationRuleInformer constructs a new informer for DestinationRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewDestinationRuleInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredDestinationRuleInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredDestinationRuleInformer constructs a new informer for DestinationRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredDestinationRuleInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1alpha3().DestinationRules(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1alpha3().DestinationRules(namespace).Watch(options)
+			},
+		},
+		&istiov1alpha3.DestinationRule{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *destinationRuleInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredDestinationRuleInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *destinationRuleInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&istiov1alpha3.DestinationRule{}, f.defaultInformer)
+}
+
+func (f *destinationRuleInformer) Lister() v1alpha3.DestinationRuleLister {
+	return v1alpha3.NewDestinationRuleLister(f.Informer().GetIndexer())
+}

vendor/github.com/knative/pkg/client/informers/externalversions/istio/v1alpha3/gateway.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2018 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	time "time"
+
+	istiov1alpha3 "github.com/knative/pkg/apis/istio/v1alpha3"
+	versioned "github.com/knative/pkg/client/clientset/versioned"
+	internalinterfaces "github.com/knative/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha3 "github.com/knative/pkg/client/listers/istio/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// GatewayInformer provides access to a shared informer and lister for
+// Gateways.
+type GatewayInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha3.GatewayLister
+}
+
+type gatewayInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewGatewayInformer constructs a new informer for Gateway type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewGatewayInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredGatewayInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredGatewayInformer constructs a new informer for Gateway type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredGatewayInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1alpha3().Gateways(namespace).List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1alpha3().Gateways(namespace).Watch(options)
+			},
+		},
+		&istiov1alpha3.Gateway{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *gatewayInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredGatewayInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *gatewayInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&istiov1alpha3.Gateway{}, f.defaultInformer)
+}
+
+func (f *gatewayInformer) Lister() v1alpha3.GatewayLister {
+	return v1alpha3.NewGatewayLister(f.Informer().GetIndexer())
+}